On Tue 2014-04-22 23:31:11, David Herrmann wrote: > Hi > > On Tue, Apr 22, 2014 at 8:58 PM, Pavel Machek <pavel@xxxxxx> wrote: > > I don't think openat helps you. This is what we are talking about, it > > is easy to reproduce. Can you reproduce it without /proc mounted? > > > > I think that chmod 700 . should stop you. Openat seems no worse than > > just placing cwd there... > > Example1: > $ mkdir -p subdir/next > $ chmod 000 subdir > $ touch subdir/next/test > => EACCES > $ cd subdir > => EACCES > > Example2: > $ mkdir -p subdir/next > $ cd subdir/next > $ chmod 000 .. > $ touch test > => SUCCESS > > This is the exact same situation. The filesystem tree is exactly the > same in both situations, but in the first example CWD is outside of > "subdir", in the second example CWD is inside of "subdir". Thus, they > can create files in that directory, even though they have no access to > _any_ absolute path to that directory. > > This is the exact same race that you describe via /proc/self/fd/. But > instead of keeping a ref to the dir via CWD, in your example you keep > the ref via a FD in that exact same directory and access it via > /proc. Yes, that's how permissions work. You snipped my example. Can you show how to write to "unwritable_file" below without /proc? Because I believe I got my chmods right. pavel@toy:/tmp$ uname -a Linux toy.ucw.cz 2.6.32-rc3 #21 Mon Oct 19 07:32:02 CEST 2009 armv5tel GNU/Linux pavel@toy:/tmp mkdir my_priv; cd my_priv pavel@toy:/tmp/my_priv$ echo this file should never be writable > unwritable_file # lock down directory pavel@toy:/tmp/my_priv$ chmod 700 . # relax file permissions, directory is private, so this is safe # check link count on unwritable_file. We would not want someone # to have a hard link to work around our permissions, would we? pavel@toy:/tmp/my_priv$ chmod 666 unwritable_file pavel@toy:/tmp/my_priv$ cat unwritable_file this file should never be writable pavel@toy:/tmp/my_priv$ cat unwritable_file got you # Security problem here > (Hint: instead of using CWD, you can also keep an FD via open(O_PATH) > and pass it to openat()) Feel free to use openat(), too. Thanks, Pavel -- (english) http://www.livejournal.com/~pavelmachek (cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html -- To unsubscribe from this list: send the line "unsubscribe linux-fsdevel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
