Re: bind mount that lies to apps about st_uid?

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Tue, Jul 14, 2015 at 5:53 PM, Dave Chinner <david@xxxxxxxxxxxxx> wrote:
> Why wouldn't you just use an ld preload library to intercept stat()
> calls in userspace and manipulate them there? No kernel changes
> required, no app changes required....

In theory I love this approach but, sadly, using LD_PRELOADed
libraries in practice has a lot of problems:
- You can't intercept intra-libc calls, so other libc functions that
might call stat() potentially need to be overridden.
- You can't intercept calls from static binaries, which are common on Sandstorm.
- You can't intercept syscalls made directly via syscall() or inline
assembly, which happen from time to time.
- The library file needs to be mapped into the container somewhere.
Normally the application controls the entire container layout, so this
is awkward.
- Lots of other issues.

Some of the above can theoretically be solved by using seccomp to
raise SIGSYS on every stat() call and perhaps using a userspace ELF
loader, but this brings its own set of complications and performance
issues and would take a long time to build.

Note that we would *love* the ability to more cleanly and robustly
filter / rewrite syscalls in userspace, for exactly this sort of
thing. But it seems the available options (ptrace and LD_PRELOAD) are
far too difficult and quirky to use effectively as-is.

-Kenton
--
To unsubscribe from this list: send the line "unsubscribe linux-fsdevel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html



[Index of Archives]     [Linux Ext4 Filesystem]     [Union Filesystem]     [Filesystem Testing]     [Ceph Users]     [Ecryptfs]     [AutoFS]     [Kernel Newbies]     [Share Photos]     [Security]     [Netfilter]     [Bugtraq]     [Yosemite News]     [MIPS Linux]     [ARM Linux]     [Linux Security]     [Linux Cachefs]     [Reiser Filesystem]     [Linux RAID]     [Samba]     [Device Mapper]     [CEPH Development]
  Powered by Linux