[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[hurd] 08/43: trans/fakeroot: Obey O_NOFOLLOW.
From: |
Samuel Thibault |
Subject: |
[hurd] 08/43: trans/fakeroot: Obey O_NOFOLLOW. |
Date: |
Mon, 11 Sep 2017 07:10:09 +0000 |
This is an automated email from the git hooks/post-receive script.
sthibault pushed a commit to branch upstream
in repository hurd.
commit 9d1b0cfb95e26fa506179bc30152989a817ff1e6
Author: Justus Winter <address@hidden>
Date: Tue Jun 20 01:06:53 2017 +0200
trans/fakeroot: Obey O_NOFOLLOW.
* trans/fakeroot.c (netfs_S_dir_lookup): Do not follow symlinks if the
client used O_NOFOLLOW.
---
trans/fakeroot.c | 60 +++++++++++++++++++++++++++++++++++++++++++++++++++++++-
1 file changed, 59 insertions(+), 1 deletion(-)
diff --git a/trans/fakeroot.c b/trans/fakeroot.c
index ad7bec9..0571c3e 100644
--- a/trans/fakeroot.c
+++ b/trans/fakeroot.c
@@ -302,16 +302,74 @@ netfs_S_dir_lookup (struct protid *diruser,
dnp = diruser->po->np;
+ /* See glibc's lookup-retry.c about O_NOFOLLOW. */
+ if (flags & O_NOFOLLOW)
+ flags |= O_NOTRANS;
+
mach_port_t dir = netfs_node_netnode (dnp)->file;
redo_lookup:
err = dir_lookup (dir, filename,
- flags & (O_NOLINK|O_RDWR|O_EXEC|O_CREAT|O_EXCL|O_NONBLOCK),
+ flags & (O_NOFOLLOW|O_NOTRANS|O_NOLINK
+ |O_RDWR|O_EXEC|O_CREAT|O_EXCL|O_NONBLOCK),
real_from_fake_mode (mode), do_retry, retry_name, &file);
if (dir != netfs_node_netnode (dnp)->file)
mach_port_deallocate (mach_task_self (), dir);
if (err)
return err;
+ /* See glibc's lookup-retry.c about O_NOFOLLOW. */
+ if (flags & O_NOFOLLOW
+ && (*do_retry == FS_RETRY_NORMAL && *retry_name == 0))
+ {
+ /* In Linux, O_NOFOLLOW means to reject symlinks. If we
+ did an O_NOLINK lookup above and io_stat here to check
+ for S_IFLNK, a translator like firmlink could easily
+ spoof this check by not showing S_IFLNK, but in fact
+ redirecting the lookup to some other name
+ (i.e. opening the very same holes a symlink would).
+
+ Instead we do an O_NOTRANS lookup above, and stat the
+ underlying node: if it has a translator set, and its
+ owner is not root (st_uid 0) then we reject it.
+ Since the motivation for this feature is security, and
+ that security presumes we trust the containing
+ directory, this check approximates the security of
+ refusing symlinks while accepting mount points.
+ Note that we actually permit something Linux doesn't:
+ we follow root-owned symlinks; if that is deemed
+ undesireable, we can add a final check for that
+ one exception to our general translator-based rule. */
+ struct stat st;
+ err = io_stat (file, &st);
+ if (!err
+ && (st.st_mode & (S_IPTRANS|S_IATRANS)))
+ {
+ if (st.st_uid != 0)
+ err = ENOENT;
+ else if (st.st_mode & S_IPTRANS)
+ {
+ char buf[1024]; /* XXX */
+ char *trans = buf;
+ size_t translen = sizeof buf;
+ err = file_get_translator (file,
+ &trans, &translen);
+ if (!err
+ && translen > sizeof _HURD_SYMLINK
+ && !memcmp (trans,
+ _HURD_SYMLINK, sizeof _HURD_SYMLINK))
+ err = ENOENT;
+
+ if (trans != buf)
+ vm_deallocate (mach_task_self (), (vm_address_t) trans,
translen);
+ }
+ }
+ if (err)
+ {
+ mach_port_deallocate (mach_task_self (), file);
+ return err;
+ }
+ }
+
switch (*do_retry)
{
case FS_RETRY_REAUTH:
--
Alioth's /usr/local/bin/git-commit-notice on
/srv/git.debian.org/git/pkg-hurd/hurd.git
- [hurd] 12/43: Fix typo., (continued)
- [hurd] 12/43: Fix typo., Samuel Thibault, 2017/09/11
- [hurd] 21/43: startup: Fix retrieving the privileged ports., Samuel Thibault, 2017/09/11
- [hurd] 25/43: eth-multiplexer: Implement getting the devices flags., Samuel Thibault, 2017/09/11
- [hurd] 20/43: ext2fs: Fix warning., Samuel Thibault, 2017/09/11
- [hurd] 18/43: Make build system more robust., Samuel Thibault, 2017/09/11
- [hurd] 14/43: procfs: Provide 'hostinfo'., Samuel Thibault, 2017/09/11
- [hurd] 23/43: startup: Improve error handling., Samuel Thibault, 2017/09/11
- [hurd] 28/43: eth-multiplexer: Allow setting of flags., Samuel Thibault, 2017/09/11
- [hurd] 33/43: libdiskfs: Use control class for the singleton 'bootinfo'., Samuel Thibault, 2017/09/11
- [hurd] 31/43: ext2fs: Improve inlining., Samuel Thibault, 2017/09/11
- [hurd] 08/43: trans/fakeroot: Obey O_NOFOLLOW.,
Samuel Thibault <=
- [hurd] 35/43: libnetfs: Remove redundant type checks., Samuel Thibault, 2017/09/11
- [hurd] 26/43: eth-multiplexer: Remove local definiton., Samuel Thibault, 2017/09/11
- [hurd] 34/43: libdiskfs: Simplify type checks., Samuel Thibault, 2017/09/11
- [hurd] 16/43: Simplify deallocations., Samuel Thibault, 2017/09/11
- [hurd] 29/43: eth-multiplexer: Respect interfaces up flags., Samuel Thibault, 2017/09/11
- [hurd] 36/43: startup: Don't spin on host_reboot failures., Samuel Thibault, 2017/09/11
- [hurd] 30/43: Drop the register qualifier., Samuel Thibault, 2017/09/11
- [hurd] 02/43: trans: New random translator., Samuel Thibault, 2017/09/11
- [hurd] 43/43: storeio: Avoid calling mmap with zero size, Samuel Thibault, 2017/09/11
- [hurd] 03/43: trans: Conditionally build the random translator., Samuel Thibault, 2017/09/11