From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp-190b.mail.infomaniak.ch (smtp-190b.mail.infomaniak.ch [185.125.25.11]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4C69472622 for ; Tue, 3 Jun 2025 12:57:16 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=185.125.25.11 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1748955440; cv=none; b=rSAVXOM0jCFJEtExE0p+mLTehWXUFlmVHm6o1TONclWZ9yCGrV6FefhG9+chXKGF3ihbZXOuBThoU83AWVXhoI9rmsZjh792WiK9XDjt4uAw8nZfA8VjY2KgxcXSY+7HGq/Gio/C6puWAFSjOB5+kn/kYzt4nFpFHMIob4hdrLM= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1748955440; c=relaxed/simple; bh=YpSUlje0QFo8fAg0UbMHlFaUYLWtmOn9kosehVUWl2c=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=hdrTNNF6ozJ79/Z9hgkr05+KjQfgnYTZwkIi99LU/MNx5NFbn9I+cgv23oUcwC18poPamI2AInz7FfPs0RBPFPcFFsrsizJ3e0cO1nKeOpPVpb7nRD+3VZdZhXW32acJCDoU7dLB6QC8L5399hehBQjB/5JeMCurn5FRq7WLzJM= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=digikod.net; spf=pass smtp.mailfrom=digikod.net; dkim=pass (1024-bit key) header.d=digikod.net header.i=@digikod.net header.b=GhiFs+Oa; arc=none smtp.client-ip=185.125.25.11 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=digikod.net Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=digikod.net Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=digikod.net header.i=@digikod.net header.b="GhiFs+Oa" Received: from smtp-4-0001.mail.infomaniak.ch (unknown [IPv6:2001:1600:7:10::a6c]) by smtp-4-3000.mail.infomaniak.ch (Postfix) with ESMTPS id 4bBVs24Wlqz19Nm; Tue, 3 Jun 2025 14:49:10 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=digikod.net; s=20191114; t=1748954950; bh=f3sEmdCXf265fZdW3agrYCmOKfWp1F1brT5D1vfWqXM=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=GhiFs+OagmKnjzrO37+j/bRCJRvL9X3nchSdSAL8QZU93u7utA+y7M8Amp3tayn7Y IO9csEQOJKBi0mYDUlEtitpv2pCrsfPbqVoQ3xYe9TAcL3iY//3waB8c/VPB78CrOt 4joM5dCTU2faTdJvacgFSKLJK8cYRtNhLvtQiqA4= Received: from unknown by smtp-4-0001.mail.infomaniak.ch (Postfix) with ESMTPA id 4bBVs15hNzzDkc; Tue, 3 Jun 2025 14:49:09 +0200 (CEST) Date: Tue, 3 Jun 2025 14:49:09 +0200 From: =?utf-8?Q?Micka=C3=ABl_Sala=C3=BCn?= To: Jan Kara Cc: Song Liu , Alexei Starovoitov , Al Viro , bpf , Linux-Fsdevel , LKML , LSM List , Kernel Team , Andrii Nakryiko , Eduard , Alexei Starovoitov , Daniel Borkmann , Martin KaFai Lau , Christian Brauner , KP Singh , Matt Bobrowski , Amir Goldstein , repnop@google.com, Jeff Layton , Josef Bacik , =?utf-8?Q?G=C3=BCnther?= Noack , Jann Horn Subject: Re: [PATCH bpf-next 3/4] bpf: Introduce path iterator Message-ID: <20250603.be1ahteePh8z@digikod.net> References: <20250528222623.1373000-1-song@kernel.org> <20250528222623.1373000-4-song@kernel.org> <20250528223724.GE2023217@ZenIV> <20250530.oh5pahH9Nui9@digikod.net> Precedence: bulk X-Mailing-List: linux-security-module@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: X-Infomaniak-Routing: alpha On Tue, Jun 03, 2025 at 11:46:22AM +0200, Jan Kara wrote: > On Fri 30-05-25 16:20:39, Mickaël Salaün wrote: > > On Thu, May 29, 2025 at 10:05:59AM -0700, Song Liu wrote: > > > On Thu, May 29, 2025 at 9:57 AM Alexei Starovoitov > > > wrote: > > > [...] > > > > > > > > > > How about we describe this as: > > > > > > > > > > Introduce a path iterator, which safely (no crash) walks a struct path. > > > > > Without malicious parallel modifications, the walk is guaranteed to > > > > > terminate. The sequence of dentries maybe surprising in presence > > > > > of parallel directory or mount tree modifications and the iteration may > > > > > not ever finish in face of parallel malicious directory tree manipulations. > > > > > > > > Hold on. If it's really the case then is the landlock susceptible > > > > to this type of attack already ? > > > > landlock may infinitely loop in the kernel ? > > > > > > I think this only happens if the attacker can modify the mount or > > > directory tree as fast as the walk, which is probably impossible > > > in reality. > > > > Yes, so this is not an infinite loop but an infinite race between the > > kernel and a very fast malicious user space process with an infinite > > number of available nested writable directories, that would also require > > a filesystem (and a kernel) supporting infinite pathname length. > > Well, you definitely don't need infinite pathname length. Example: > > Have a dir hierarchy like: > > A > / \ > B C > | > D > > Start iterating from A/B/D, you climb up to A/B. In parallel atacker does: > > mv A/B/ A/C/; mkdir A/B > > Now by following parent you get to A/C. In parallel attaker does: > > mv A/C/ A/B/; mkdir A/C > > And now you are essentially where you've started so this can repeat > forever. Yes, this is the scenario I had in mind talking about "infinite race" (instead of infinite loop). For this to work it will require the filesystem to support an infinite number of nested directories, but I'm not sure which FS could be eligible. Anyway, what would would be the threat model for this infinite race? > > As others wrote this particular timing might be hard enough to hit for it > to not be a practical attack but I would not bet much on somebody not being > able to invent some variant that works, in particular with BPF iterator. There might exist corner cases that could be an issue but would the impact be different than with other kinds of path walk? What could we do to avoid or limit such issue? > > Honza > -- > Jan Kara > SUSE Labs, CR