Re: [PATCH v2] fs: block cross-uid sticky symlinks

[Kees Cook <kees.cook@canonical.com>]

Hi Christoph,

On Mon, May 31, 2010 at 06:35:10AM -0400, Christoph Hellwig wrote:
> NAK for changing this in core code.  These are long-living and
> documented semantics that we can't simply break, and as Alan mentioned
> having there's good enough workaround that don't break applications.

I totally disagree -- there are no applications that depend on this
behavior in sticky world-writable directories.  Adding this logic (where
ever it lands) fixes /tmp symlink races forever and breaks nothing.

> Feel free to shovel it into the crackpot LSM of your choice.

I have no strong opinion about where it should live.  The strong opinion
I have is that all Linux users, regardless of LSM choice, should benefit
from the fix.

I'd like to separate objections about implementation from objections about
the change in semantics itself.  If every user of Linux gains this symlink
protection, does it matter if it's in core VFS or in commoncaps?

Expecting the push-back from VFS, I wrote this patch against commoncaps.

James, would you take it there (along with the patch to SELinux to call
out to commoncaps) if there is no way to proceed with the VFS core towards
solving this?

Thanks,

-Kees

-- 
Kees Cook
Ubuntu Security Team