Re: Should unprivileged linkat(..., AT_EMPTY_PATH) work on O_TMPFILE files?

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Sun, Aug 11, 2013 at 9:45 AM, Aneesh Kumar K.V
<aneesh.kumar@xxxxxxxxxxxxxxxxxx> wrote:
> Andy Lutomirski <luto@xxxxxxxxxxxxxx> writes:
>
>> The change:
>>
>> commit f4e0c30c191f87851c4a53454abb55ee276f4a7e
>> Author: Al Viro <viro@xxxxxxxxxxxxxxxxxx>
>> Date:   Tue Jun 11 08:34:36 2013 +0400
>>
>>     allow the temp files created by open() to be linked to
>>
>>     O_TMPFILE | O_CREAT => linkat() with AT_SYMLINK_FOLLOW and /proc/self/fd/<n>
>>     as oldpath (i.e. flink()) will create a link
>>     O_TMPFILE | O_CREAT | O_EXCL => ENOENT on attempt to link those guys
>>
>>     Signed-off-by: Al Viro <viro@xxxxxxxxxxxxxxxxxx>
>>
>> makes it possible to hardlink an O_TMPFILE file using procfs.  Should
>> linkat(fd, "", newdirfd, newpath, AT_EMPTY_PATH) also work?
>>
>> AFAICS it currently requires CAP_DAC_READ_SEARCH, but I'm a bit
>> confused as to why linkat(..., AT_EMPTY_PATH) should have a stricter
>> check than linkat(AT_FDCWD, "/proc/self/fd/n", ...,
>> AT_SYMLINK_FOLLOW),  (The relevant change is
>> 11a7b371b64ef39fc5fb1b6f2218eef7c4d035e3.)
>>
>> FWIW, this program works on Linux 3.9, which makes me doubt that the
>> security restriction on linkat is doing any good:
>>
>> #include <stdio.h>
>> #include <err.h>
>> #include <fcntl.h>
>> #include <unistd.h>
>>
>> int main(int argc, char **argv)
>> {
>>   char buf[128];
>>
>>   if (argc != 3)
>>     errx(1, "Usage: flink FD PATH");
>>
>>   sprintf(buf, "/proc/self/fd/%d", atoi(argv[1]));
>>   if (linkat(AT_FDCWD, buf, AT_FDCWD, argv[2], AT_SYMLINK_FOLLOW) != 0)
>>     err(1, "linkat");
>>   return 0;
>> }
>>
>>
>> Removing the check from the AT_EMPTY_PATH case would simplify code
>> that wants to write a file, fsync it, and then flink it in.
>
> I understand that this got merged upstream. But in case of the above
> test we would walk the path pointed by /proc/self/fd/<x> right ?
>
> ie,
>
> 20 -> /home/no-access/k
>
> will the above test work ? Now if i pass the '20' to another application
> I can affectively create a hardlink to that outside no-access and if k
> happens to have 'r' for others, then everybody will be able to read
> right ?. I understand that limitting the read access based on directory
> permission is not a good idea. But aren't we expected to keep that ?

The symlinks in /proc/self/fd are rather magical and don't actually
walk the path.  Give it a try :)

--Andy
--
To unsubscribe from this list: send the line "unsubscribe linux-fsdevel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html




[Index of Archives]     [Linux Ext4 Filesystem]     [Union Filesystem]     [Filesystem Testing]     [Ceph Users]     [Ecryptfs]     [AutoFS]     [Kernel Newbies]     [Share Photos]     [Security]     [Netfilter]     [Bugtraq]     [Yosemite News]     [MIPS Linux]     [ARM Linux]     [Linux Security]     [Linux Cachefs]     [Reiser Filesystem]     [Linux RAID]     [Samba]     [Device Mapper]     [CEPH Development]
  Powered by Linux