From: Aleksa Sarai <cyphar@cyphar•com>
To: Al Viro <viro@zeniv•linux.org.uk>,
Jeff Layton <jlayton@kernel•org>,
"J. Bruce Fields" <bfields@fieldses•org>,
Arnd Bergmann <arnd@arndb•de>,
David Howells <dhowells@redhat•com>,
Shuah Khan <shuah@kernel•org>,
Shuah Khan <skhan@linuxfoundation•org>,
Ingo Molnar <mingo@redhat•com>,
Peter Zijlstra <peterz@infradead•org>,
Alexei Starovoitov <ast@kernel•org>,
Daniel Borkmann <daniel@iogearbox•net>,
Martin KaFai Lau <kafai@fb•com>, Song Liu <songliubraving@fb•com>,
Yonghong Song <yhs@fb•com>, Andrii Nakryiko <andriin@fb•com>
Cc: linux-ia64@vger•kernel.org, linux-sh@vger•kernel.org,
Alexander Shishkin <alexander.shishkin@linux•intel.com>,
Rasmus Villemoes <linux@rasmusvillemoes•dk>,
linux-kernel@vger•kernel.org, linux-kselftest@vger•kernel.org,
sparclinux@vger•kernel.org, linux-api@vger•kernel.org,
Jiri Olsa <jolsa@redhat•com>,
linux-arch@vger•kernel.org, linux-s390@vger•kernel.org,
Tycho Andersen <tycho@tycho•ws>, Aleksa Sarai <asarai@suse•de>,
David Drysdale <drysdale@google•com>,
linux-arm-kernel@lists•infradead.org, linux-mips@vger•kernel.org,
linux-xtensa@linux-xtensa•org, Kees Cook <keescook@chromium•org>,
Jann Horn <jannh@google•com>,
linuxppc-dev@lists•ozlabs.org, dev@opencontainers•org,
Aleksa Sarai <cyphar@cyphar•com>,
Andy Lutomirski <luto@kernel•org>,
Namhyung Kim <namhyung@kernel•org>,
Andrew Morton <akpm@linux-foundation•org>,
Christian Brauner <christian@brauner•io>,
libc-alpha@sourceware•org, linux-parisc@vger•kernel.org,
linux-m68k@lists•linux-m68k.org, netdev@vger•kernel.org,
Chanho Min <chanho.min@lge•com>, Oleg Nesterov <oleg@redhat•com>,
Eric Biederman <ebiederm@xmission•com>,
linux-alpha@vger•kernel.org, linux-fsdevel@vger•kernel.org,
bpf@vger•kernel.org,
Linus Torvalds <torvalds@linux-foundation•org>,
containers@lists•linux-foundation.org
Subject: [PATCH v16 03/12] namei: allow set_root() to produce errors
Date: Sat, 16 Nov 2019 11:27:53 +1100 [thread overview]
Message-ID: <20191116002802.6663-4-cyphar@cyphar.com> (raw)
In-Reply-To: <20191116002802.6663-1-cyphar@cyphar.com>
For LOOKUP_BENEATH and LOOKUP_IN_ROOT it is necessary to ensure that
set_root() is never called, and thus (for hardening purposes) it should
return an error rather than permit a breakout from the root. In
addition, move all of the repetitive set_root() calls to nd_jump_root().
Signed-off-by: Aleksa Sarai <cyphar@cyphar•com>
---
fs/namei.c | 35 ++++++++++++++++++++++++-----------
1 file changed, 24 insertions(+), 11 deletions(-)
diff --git a/fs/namei.c b/fs/namei.c
index 965a25b2e3df..259652667881 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -798,7 +798,7 @@ static int complete_walk(struct nameidata *nd)
return status;
}
-static void set_root(struct nameidata *nd)
+static int set_root(struct nameidata *nd)
{
struct fs_struct *fs = current->fs;
@@ -814,6 +814,7 @@ static void set_root(struct nameidata *nd)
get_fs_root(fs, &nd->root);
nd->flags |= LOOKUP_ROOT_GRABBED;
}
+ return 0;
}
static void path_put_conditional(struct path *path, struct nameidata *nd)
@@ -837,6 +838,11 @@ static inline void path_to_nameidata(const struct path *path,
static int nd_jump_root(struct nameidata *nd)
{
+ if (!nd->root.mnt) {
+ int error = set_root(nd);
+ if (error)
+ return error;
+ }
if (nd->flags & LOOKUP_RCU) {
struct dentry *d;
nd->path = nd->root;
@@ -1080,10 +1086,9 @@ const char *get_link(struct nameidata *nd)
return res;
}
if (*res == '/') {
- if (!nd->root.mnt)
- set_root(nd);
- if (unlikely(nd_jump_root(nd)))
- return ERR_PTR(-ECHILD);
+ error = nd_jump_root(nd);
+ if (unlikely(error))
+ return ERR_PTR(error);
while (unlikely(*++res == '/'))
;
}
@@ -1698,8 +1703,13 @@ static inline int may_lookup(struct nameidata *nd)
static inline int handle_dots(struct nameidata *nd, int type)
{
if (type == LAST_DOTDOT) {
- if (!nd->root.mnt)
- set_root(nd);
+ int error = 0;
+
+ if (!nd->root.mnt) {
+ error = set_root(nd);
+ if (error)
+ return error;
+ }
if (nd->flags & LOOKUP_RCU) {
return follow_dotdot_rcu(nd);
} else
@@ -2162,6 +2172,7 @@ static int link_path_walk(const char *name, struct nameidata *nd)
/* must be paired with terminate_walk() */
static const char *path_init(struct nameidata *nd, unsigned flags)
{
+ int error;
const char *s = nd->name->name;
if (!*s)
@@ -2194,11 +2205,13 @@ static const char *path_init(struct nameidata *nd, unsigned flags)
nd->path.dentry = NULL;
nd->m_seq = read_seqbegin(&mount_lock);
+
+ /* Figure out the starting path and root (if needed). */
if (*s == '/') {
- set_root(nd);
- if (likely(!nd_jump_root(nd)))
- return s;
- return ERR_PTR(-ECHILD);
+ error = nd_jump_root(nd);
+ if (unlikely(error))
+ return ERR_PTR(error);
+ return s;
} else if (nd->dfd == AT_FDCWD) {
if (flags & LOOKUP_RCU) {
struct fs_struct *fs = current->fs;
--
2.24.0
WARNING: multiple messages have this Message-ID (diff)
From: Aleksa Sarai <cyphar@cyphar•com>
To: Al Viro <viro@zeniv•linux.org.uk>,
Jeff Layton <jlayton@kernel•org>,
"J. Bruce Fields" <bfields@fieldses•org>,
Arnd Bergmann <arnd@arndb•de>,
David Howells <dhowells@redhat•com>,
Shuah Khan <shuah@kernel•org>,
Shuah Khan <skhan@linuxfoundation•org>,
Ingo Molnar <mingo@redhat•com>,
Peter Zijlstra <peterz@infradead•org>,
Alexei Starovoitov <ast@kernel•org>,
Daniel Borkmann <daniel@iogearbox•net>,
Martin KaFai Lau <kafai@fb•com>, Song Liu <songliubraving@fb•com>,
Yonghong Song <yhs@fb•com>, Andrii Nakryiko <andriin@fb•com>
Cc: Aleksa Sarai <cyphar@cyphar•com>,
Eric Biederman <ebiederm@xmission•com>,
Andy Lutomirski <luto@kernel•org>,
Andrew Morton <akpm@linux-foundation•org>,
Kees Cook <keescook@chromium•org>, Jann Horn <jannh@google•com>,
Tycho Andersen <tycho@tycho•ws>,
David Drysdale <drysdale@google•com>,
Chanho Min <chanho.min@lge•com>, Oleg Nesterov <oleg@redhat•com>,
Rasmus Villemoes <linux@rasmusvillemoes•dk>,
Alexander Shishkin <alexander.shishkin@linux•intel.com>,
Jiri Olsa <jolsa@redhat•com>, Namhyung Kim <namhyung@kernel•org>,
Christian Brauner <christian@brauner•io>,
Aleksa Sarai <asarai@suse•de>,
Linus Torvalds <torvalds@linux-foundation•org>,
dev@opencontainers•org, containers@lists•linux-foundation.org,
bpf@vger•kernel.org, netdev@vger•kernel.org,
linux-alpha@vger•kernel.org, linux-api@vger•kernel.org,
libc-alpha@sourceware•org, linux-arch@vger•kernel.org,
linux-arm-kernel@lists•infradead.org,
linux-fsdevel@vger•kernel.org, linux-ia64@vger•kernel.org,
linux-kernel@vger•kernel.org, linux-kselftest@vger•kernel.org,
linux-m68k@lists•linux-m68k.org, linux-mips@vger•kernel.org,
linux-parisc@vger•kernel.org, linuxppc-dev@lists•ozlabs.org,
linux-s390@vger•kernel.org, linux-sh@vger•kernel.org,
linux-xtensa@linux-xtensa•org, sparclinux@vger•kernel.org
Subject: [PATCH v16 03/12] namei: allow set_root() to produce errors
Date: Sat, 16 Nov 2019 11:27:53 +1100 [thread overview]
Message-ID: <20191116002802.6663-4-cyphar@cyphar.com> (raw)
Message-ID: <20191116002753.6FhtTV3mQ9vtE179j6M8Ql_iZtsnGCHnk7c0QwBrnLM@z> (raw)
In-Reply-To: <20191116002802.6663-1-cyphar@cyphar.com>
For LOOKUP_BENEATH and LOOKUP_IN_ROOT it is necessary to ensure that
set_root() is never called, and thus (for hardening purposes) it should
return an error rather than permit a breakout from the root. In
addition, move all of the repetitive set_root() calls to nd_jump_root().
Signed-off-by: Aleksa Sarai <cyphar@cyphar•com>
---
fs/namei.c | 35 ++++++++++++++++++++++++-----------
1 file changed, 24 insertions(+), 11 deletions(-)
diff --git a/fs/namei.c b/fs/namei.c
index 965a25b2e3df..259652667881 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -798,7 +798,7 @@ static int complete_walk(struct nameidata *nd)
return status;
}
-static void set_root(struct nameidata *nd)
+static int set_root(struct nameidata *nd)
{
struct fs_struct *fs = current->fs;
@@ -814,6 +814,7 @@ static void set_root(struct nameidata *nd)
get_fs_root(fs, &nd->root);
nd->flags |= LOOKUP_ROOT_GRABBED;
}
+ return 0;
}
static void path_put_conditional(struct path *path, struct nameidata *nd)
@@ -837,6 +838,11 @@ static inline void path_to_nameidata(const struct path *path,
static int nd_jump_root(struct nameidata *nd)
{
+ if (!nd->root.mnt) {
+ int error = set_root(nd);
+ if (error)
+ return error;
+ }
if (nd->flags & LOOKUP_RCU) {
struct dentry *d;
nd->path = nd->root;
@@ -1080,10 +1086,9 @@ const char *get_link(struct nameidata *nd)
return res;
}
if (*res == '/') {
- if (!nd->root.mnt)
- set_root(nd);
- if (unlikely(nd_jump_root(nd)))
- return ERR_PTR(-ECHILD);
+ error = nd_jump_root(nd);
+ if (unlikely(error))
+ return ERR_PTR(error);
while (unlikely(*++res == '/'))
;
}
@@ -1698,8 +1703,13 @@ static inline int may_lookup(struct nameidata *nd)
static inline int handle_dots(struct nameidata *nd, int type)
{
if (type == LAST_DOTDOT) {
- if (!nd->root.mnt)
- set_root(nd);
+ int error = 0;
+
+ if (!nd->root.mnt) {
+ error = set_root(nd);
+ if (error)
+ return error;
+ }
if (nd->flags & LOOKUP_RCU) {
return follow_dotdot_rcu(nd);
} else
@@ -2162,6 +2172,7 @@ static int link_path_walk(const char *name, struct nameidata *nd)
/* must be paired with terminate_walk() */
static const char *path_init(struct nameidata *nd, unsigned flags)
{
+ int error;
const char *s = nd->name->name;
if (!*s)
@@ -2194,11 +2205,13 @@ static const char *path_init(struct nameidata *nd, unsigned flags)
nd->path.dentry = NULL;
nd->m_seq = read_seqbegin(&mount_lock);
+
+ /* Figure out the starting path and root (if needed). */
if (*s == '/') {
- set_root(nd);
- if (likely(!nd_jump_root(nd)))
- return s;
- return ERR_PTR(-ECHILD);
+ error = nd_jump_root(nd);
+ if (unlikely(error))
+ return ERR_PTR(error);
+ return s;
} else if (nd->dfd == AT_FDCWD) {
if (flags & LOOKUP_RCU) {
struct fs_struct *fs = current->fs;
--
2.24.0
next prev parent reply other threads:[~2019-11-16 0:38 UTC|newest]
Thread overview: 34+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-11-16 0:27 [PATCH v16 00/12] open: introduce openat2(2) syscall Aleksa Sarai
2019-11-16 0:27 ` Aleksa Sarai
2019-11-16 0:27 ` [PATCH v16 01/12] nsfs: clean-up ns_get_path() signature to return int Aleksa Sarai
2019-11-16 0:27 ` Aleksa Sarai
2019-11-16 0:27 ` [PATCH v16 02/12] namei: allow nd_jump_link() to produce errors Aleksa Sarai
2019-11-16 0:27 ` Aleksa Sarai
2019-11-16 0:37 ` Al Viro
2019-11-16 0:37 ` Al Viro
2019-11-16 18:09 ` Aleksa Sarai
2019-11-16 18:09 ` Aleksa Sarai
2019-11-16 0:27 ` Aleksa Sarai [this message]
2019-11-16 0:27 ` [PATCH v16 03/12] namei: allow set_root() " Aleksa Sarai
2019-11-16 0:27 ` [PATCH v16 04/12] namei: LOOKUP_NO_SYMLINKS: block symlink resolution Aleksa Sarai
2019-11-16 0:27 ` Aleksa Sarai
2019-11-16 0:27 ` [PATCH v16 05/12] namei: LOOKUP_NO_MAGICLINKS: block magic-link resolution Aleksa Sarai
2019-11-16 0:27 ` Aleksa Sarai
2019-11-16 0:27 ` [PATCH v16 06/12] namei: LOOKUP_NO_XDEV: block mountpoint crossing Aleksa Sarai
2019-11-16 0:27 ` Aleksa Sarai
2019-11-16 1:01 ` Al Viro
2019-11-16 17:24 ` Aleksa Sarai
2019-11-16 0:27 ` [PATCH v16 07/12] namei: LOOKUP_BENEATH: O_BENEATH-like scoped resolution Aleksa Sarai
2019-11-16 0:27 ` Aleksa Sarai
2019-11-16 0:27 ` [PATCH v16 08/12] namei: LOOKUP_IN_ROOT: chroot-like " Aleksa Sarai
2019-11-16 0:27 ` Aleksa Sarai
2019-11-16 0:27 ` [PATCH v16 09/12] namei: LOOKUP_{IN_ROOT, BENEATH}: permit limited ".." resolution Aleksa Sarai
2019-11-16 0:27 ` [PATCH v16 09/12] namei: LOOKUP_{IN_ROOT,BENEATH}: " Aleksa Sarai
2019-11-16 1:03 ` Al Viro
2019-11-16 16:38 ` Aleksa Sarai
2019-11-16 0:28 ` [PATCH v16 10/12] open: introduce openat2(2) syscall Aleksa Sarai
2019-11-16 0:28 ` Aleksa Sarai
2019-11-16 0:28 ` [PATCH v16 11/12] selftests: add openat2(2) selftests Aleksa Sarai
2019-11-16 0:28 ` Aleksa Sarai
2019-11-16 0:28 ` [PATCH v16 12/12] Documentation: path-lookup: include new LOOKUP flags Aleksa Sarai
2019-11-16 0:28 ` Aleksa Sarai
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20191116002802.6663-4-cyphar@cyphar.com \
--to=cyphar@cyphar$(echo .)com \
--cc=akpm@linux-foundation$(echo .)org \
--cc=alexander.shishkin@linux$(echo .)intel.com \
--cc=andriin@fb$(echo .)com \
--cc=arnd@arndb$(echo .)de \
--cc=asarai@suse$(echo .)de \
--cc=ast@kernel$(echo .)org \
--cc=bfields@fieldses$(echo .)org \
--cc=bpf@vger$(echo .)kernel.org \
--cc=chanho.min@lge$(echo .)com \
--cc=christian@brauner$(echo .)io \
--cc=containers@lists$(echo .)linux-foundation.org \
--cc=daniel@iogearbox$(echo .)net \
--cc=dev@opencontainers$(echo .)org \
--cc=dhowells@redhat$(echo .)com \
--cc=drysdale@google$(echo .)com \
--cc=ebiederm@xmission$(echo .)com \
--cc=jannh@google$(echo .)com \
--cc=jlayton@kernel$(echo .)org \
--cc=jolsa@redhat$(echo .)com \
--cc=kafai@fb$(echo .)com \
--cc=keescook@chromium$(echo .)org \
--cc=libc-alpha@sourceware$(echo .)org \
--cc=linux-alpha@vger$(echo .)kernel.org \
--cc=linux-api@vger$(echo .)kernel.org \
--cc=linux-arch@vger$(echo .)kernel.org \
--cc=linux-arm-kernel@lists$(echo .)infradead.org \
--cc=linux-fsdevel@vger$(echo .)kernel.org \
--cc=linux-ia64@vger$(echo .)kernel.org \
--cc=linux-kernel@vger$(echo .)kernel.org \
--cc=linux-kselftest@vger$(echo .)kernel.org \
--cc=linux-m68k@lists$(echo .)linux-m68k.org \
--cc=linux-mips@vger$(echo .)kernel.org \
--cc=linux-parisc@vger$(echo .)kernel.org \
--cc=linux-s390@vger$(echo .)kernel.org \
--cc=linux-sh@vger$(echo .)kernel.org \
--cc=linux-xtensa@linux-xtensa$(echo .)org \
--cc=linux@rasmusvillemoes$(echo .)dk \
--cc=linuxppc-dev@lists$(echo .)ozlabs.org \
--cc=luto@kernel$(echo .)org \
--cc=mingo@redhat$(echo .)com \
--cc=namhyung@kernel$(echo .)org \
--cc=netdev@vger$(echo .)kernel.org \
--cc=oleg@redhat$(echo .)com \
--cc=peterz@infradead$(echo .)org \
--cc=shuah@kernel$(echo .)org \
--cc=skhan@linuxfoundation$(echo .)org \
--cc=songliubraving@fb$(echo .)com \
--cc=sparclinux@vger$(echo .)kernel.org \
--cc=torvalds@linux-foundation$(echo .)org \
--cc=tycho@tycho$(echo .)ws \
--cc=viro@zeniv$(echo .)linux.org.uk \
--cc=yhs@fb$(echo .)com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox