newline characters in unix socket names and /proc/net/unix

newline characters in unix socket names and /proc/net/unix

[Stephane Chazelas]

Hello,

it seems the kernel doesn't escape newline characters in the
file names displayed in /proc/net/unix

That file has this format:

Num       RefCount Protocol Flags    Type St Inode Path
ffff8802441bcb40: 00000002 00000000 00000000 0002 01  9219 /run/systemd/shutdownd
ffff8800a0651780: 00000002 00000000 00010000 0001 01 37020 /tmp/.menu-cached-:0-stephane
[...]


and is used by things like fuser, lsof for instance to map Inode
to Path (and libgtop, systemd (to check which sockets are still
in use for cleanup) at least).

# fuser /run/systemd/shutdownd
/run/systemd/shutdownd:     1
# fuser /tmp/.menu-cached-:0-stephane
/tmp/.menu-cached-:0-stephane:  4263

Now, one can bind a socket like:

socket=$'/tmp/foo\nffff8802441bcb40: 00000002 00000000 00000000 0002 01  9219 /tmp/.menu-cached-:0-stephane'
mkdir -p "${socket%/*}"
nc -lU "$socket"

Now /proc/net/unix has

Num       RefCount Protocol Flags    Type St Inode Path
ffff8802441bcb40: 00000002 00000000 00000000 0002 01  9219 /run/systemd/shutdownd
ffff8800a0651780: 00000002 00000000 00010000 0001 01 37020 /tmp/.menu-cached-:0-stephane
ffff880104af9400: 00000002 00000000 00010000 0001 01 5918000 /tmp/foo
ffff8802441bcb40: 00000002 00000000 00000000 0002 01  9219 /tmp/.menu-cached-:0-stephane

And fuser gives:

# fuser /run/systemd/shutdownd
# fuser /tmp/.menu-cached-:0-stephane
/tmp/.menu-cached-:0-stephane:     1  4263

Which could be a problem if the output of fuser were used to
decide what process to kill (like with -k).

I think at least newline characters (and the escape character
itself) should be escaped in there, maybe do something similar
to what is currently done for the process name in
/proc/self/status

(fuser and lsof and the other tools would also need to be
updated to take the change into account, note that lsof already
chokes on space/tab/colon in there which I've already reported
to Vic).

Also note that /proc/net/unix doesn't change after a socket file
has been renamed, so even after that issue is fixed, fuser -k on
a socket may not be very reliable. Maybe it would help if the
filesystem device/inode for the socket file were added to
/proc/net/unix and/or if the path was updated like for the
symlink targets of /proc/self/fd/*.

-- 
Stephane

Re: newline characters in unix socket names and /proc/net/unix

[Stephane Chazelas]

2015-03-14 22:33:42 +0000, Stephane Chazelas:
[...]
> it seems the kernel doesn't escape newline characters in the
> file names displayed in /proc/net/unix
[...]
> and is used by things like fuser, lsof for instance to map Inode
> to Path (and libgtop, systemd (to check which sockets are still
> in use for cleanup) at least).
[...]

A solution for fuser and lsof (at least) would be to use the new
netlink-based API where available (like "ss -ax" does on recent
systems) that doesn't have the problem.

For lsof, that would also mean (for linux-3.3 and above) that it
could display information about the peer of the socket (like it
does with lsof -E for pipes).

-- 
Stephane