On 2022/06/07 21:27, Christian Brauner wrote:
> When path conditions are specified tomoyo tries to retrieve information about
> the parent dentry. It currently assumes that the parent dentry is always
> reachable from the child dentry's mount. This assumption is wrong when
> bind-mounts are in play:
Thank you for a patch, but I consider that current behavior is correct.
> file read /foo/file1 path1.parent.uid=12
The path{1,2}.* and path{1,2}.parent.* conditions use inode's attributes.
That is, these conditions are independent with pathname reachability.
---------- Initialization ----------
# mkdir -p /foo /bar
# touch /foo/file1 /bar/file2
# chown 100 /foo
# chown 200 /foo/file1
# chown 300 /bar
# chown 400 /bar/file2
---------- Before doing bind mount ----------
# cat /foo/file1 /bar/file2
---------- Access log of before doing bind mount ----------
#2022/06/07 13:47:14# profile=2 mode=permissive granted=no (global-pid=2757) task={ pid=2757 ppid=2690 uid=0 gid=0 euid=0 egid=0 suid=0 sgid=0 fsuid=0 fsgid=0 } path1={ uid=200 gid=0 ino=2501389 major=8 minor=1 perm=0644 type=file } path1.parent={ uid=100 gid=0 ino=2501384 perm=0755 }
<kernel> /usr/sbin/sshd /usr/bin/bash /usr/bin/cat
file read /foo/file1
#2022/06/07 13:47:14# profile=2 mode=permissive granted=no (global-pid=2757) task={ pid=2757 ppid=2690 uid=0 gid=0 euid=0 egid=0 suid=0 sgid=0 fsuid=0 fsgid=0 } path1={ uid=400 gid=0 ino=273557228 major=8 minor=1 perm=0644 type=file } path1.parent={ uid=300 gid=0 ino=273557227 perm=0755 }
<kernel> /usr/sbin/sshd /usr/bin/bash /usr/bin/cat
file read /bar/file2
---------- After doing bind mount ----------
# mount --bind /bar/file2 /foo/file1
# cat /foo/file1 /bar/file2
---------- Access log of after doing bind mount ----------
#2022/06/07 13:48:46# profile=2 mode=permissive granted=no (global-pid=2773) task={ pid=2773 ppid=2690 uid=0 gid=0 euid=0 egid=0 suid=0 sgid=0 fsuid=0 fsgid=0 } path1={ uid=400 gid=0 ino=273557228 major=8 minor=1 perm=0644 type=file } path1.parent={ uid=300 gid=0 ino=273557227 perm=0755 }
<kernel> /usr/sbin/sshd /usr/bin/bash /usr/bin/cat
file read /foo/file1
#2022/06/07 13:48:46# profile=2 mode=permissive granted=no (global-pid=2773) task={ pid=2773 ppid=2690 uid=0 gid=0 euid=0 egid=0 suid=0 sgid=0 fsuid=0 fsgid=0 } path1={ uid=400 gid=0 ino=273557228 major=8 minor=1 perm=0644 type=file } path1.parent={ uid=300 gid=0 ino=273557227 perm=0755 }
<kernel> /usr/sbin/sshd /usr/bin/bash /usr/bin/cat
file read /bar/file2
