From: Al Viro <viro@ZenIV.linux.org.uk>
To: "Eric W. Biederman" <ebiederm@xmission.com>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
Kay Sievers <kay.sievers@vrfy.org>,
"Serge E. Hallyn" <serge@hallyn.com>,
containers@lists.linux-foundation.org,
Dave Hansen <haveblue@us.ibm.com>,
linux-kernel@vger.kernel.org, Andy Whitcroft <apw@canonical.com>,
sukadev@linux.vnet.ibm.com,
Linus Torvalds <torvalds@linux-foundation.org>,
Alan Cox <alan@lxorguk.ukuu.org.uk>,
Serge Hallyn <serge.hallyn@canonical.com>
Subject: Re: [PATCH 3/4] devpts: Make the newinstance option historical
Date: Sun, 23 Sep 2012 07:30:38 +0100 [thread overview]
Message-ID: <20120923063038.GO13973@ZenIV.linux.org.uk> (raw)
In-Reply-To: <87bogx5lg7.fsf@xmission.com>
On Sat, Sep 22, 2012 at 10:59:04PM -0700, Eric W. Biederman wrote:
> The test:
> >> + if (filp->f_vfsmnt->mnt_root == filp->f_dentry)
> kicks in and no redirection is performed.
Umm... OK, after the first round of recursion. Unless you bind /something/pts
on /something. Or simply create a symlink. Hell, if static /dev is on the
same fs as /tmp, it can even be done by unpriveleged attacker -
mkdir /tmp/pts
ln /dev/ptmx /tmp
ln -s /tmp/ptmx /tmp/pts/ptmx
exec </tmp/ptmx
and enjoy the stack overflow in kernel mode. It's not particulary common
setup, of course, but I think it demonstrates that you are playing with
fire...
next prev parent reply other threads:[~2012-09-23 6:30 UTC|newest]
Thread overview: 36+ messages / expand[flat|nested] mbox.gz Atom feed top
2012-01-24 0:05 [RFC] fix devpts mount behavior Serge Hallyn
2012-01-24 0:13 ` Linus Torvalds
2012-01-24 0:25 ` Serge Hallyn
2012-01-24 0:41 ` Linus Torvalds
2012-01-24 1:07 ` Al Viro
2012-01-24 18:21 ` Serge E. Hallyn
2012-01-24 20:16 ` Sukadev Bhattiprolu
2012-01-24 20:53 ` Serge E. Hallyn
2012-01-24 20:24 ` Eric W. Biederman
2012-01-24 22:02 ` Serge E. Hallyn
2012-01-24 22:54 ` Kay Sievers
2012-01-24 23:16 ` Serge Hallyn
2012-01-24 23:25 ` Sukadev Bhattiprolu
2012-01-24 23:29 ` Serge E. Hallyn
2012-01-24 23:27 ` Kay Sievers
2012-01-28 19:51 ` Serge Hallyn
2012-01-28 20:52 ` Eric W. Biederman
2012-01-28 21:32 ` Kay Sievers
2012-09-23 3:47 ` [PATCH 0/4] devpts: " Eric W. Biederman
2012-09-23 3:48 ` [PATCH 1/4] devpts: Remove CONFIG_DEVPTS_MULTIPLE_INSTANCES Eric W. Biederman
2012-09-23 3:49 ` [PATCH 2/4] devpts: Set the default permissions of /dev/pts/ptmx and /dev/ptmx to 0666 Eric W. Biederman
2012-09-23 3:50 ` [PATCH 3/4] devpts: Make the newinstance option historical Eric W. Biederman
2012-09-23 4:19 ` Al Viro
2012-09-23 4:46 ` Al Viro
2012-09-23 5:59 ` Eric W. Biederman
2012-09-23 6:30 ` Al Viro [this message]
2012-09-23 6:34 ` Al Viro
2012-09-23 7:00 ` Eric W. Biederman
2012-09-23 3:51 ` [PATCH 4/4] devpts: Update the documentation Eric W. Biederman
2012-09-23 16:48 ` [PATCH 0/4] devpts: fix devpts mount behavior H. Peter Anvin
2012-09-23 17:42 ` Eric W. Biederman
2012-09-23 17:44 ` H. Peter Anvin
2012-01-24 23:35 ` [RFC] " Eric W. Biederman
2012-01-24 20:55 ` Sukadev Bhattiprolu
2012-01-24 21:19 ` Nick Bowler
2012-01-24 0:26 ` Al Viro
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20120923063038.GO13973@ZenIV.linux.org.uk \
--to=viro@zeniv.linux.org.uk \
--cc=alan@lxorguk.ukuu.org.uk \
--cc=apw@canonical.com \
--cc=containers@lists.linux-foundation.org \
--cc=ebiederm@xmission.com \
--cc=gregkh@linuxfoundation.org \
--cc=haveblue@us.ibm.com \
--cc=kay.sievers@vrfy.org \
--cc=linux-kernel@vger.kernel.org \
--cc=serge.hallyn@canonical.com \
--cc=serge@hallyn.com \
--cc=sukadev@linux.vnet.ibm.com \
--cc=torvalds@linux-foundation.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox