From: Miklos Szeredi <miklos@szeredi.hu>
To: Vivek Goyal <vgoyal@redhat.com>
Cc: linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org,
kvm@vger.kernel.org, linux-nvdimm@lists.01.org,
stefanha@redhat.com, dgilbert@redhat.com, swhiteho@redhat.com
Subject: Re: [PATCH v2 02/30] fuse: Clear setuid bit even in cache=never path
Date: Mon, 20 May 2019 16:44:37 +0200 [thread overview]
Message-ID: <20190520144437.GB24093@localhost.localdomain> (raw)
In-Reply-To: <20190520144137.GA24093@localhost.localdomain>
[-- Attachment #1: Type: text/plain, Size: 672 bytes --]
On Mon, May 20, 2019 at 04:41:37PM +0200, Miklos Szeredi wrote:
> On Wed, May 15, 2019 at 03:26:47PM -0400, Vivek Goyal wrote:
> > If fuse daemon is started with cache=never, fuse falls back to direct IO.
> > In that write path we don't call file_remove_privs() and that means setuid
> > bit is not cleared if unpriviliged user writes to a file with setuid bit set.
> >
> > pjdfstest chmod test 12.t tests this and fails.
>
> I think better sulution is to tell the server if the suid bit needs to be
> removed, so it can do so in a race free way.
>
> Here's the kernel patch, and I'll reply with the libfuse patch.
Here are the patches for libfuse and passthrough_ll.
[-- Attachment #2: libfuse-add-fuse_write_kill_priv.patch --]
[-- Type: text/plain, Size: 2439 bytes --]
---
include/fuse_common.h | 5 ++++-
include/fuse_kernel.h | 2 ++
lib/fuse_lowlevel.c | 12 ++++++++----
3 files changed, 14 insertions(+), 5 deletions(-)
--- a/include/fuse_common.h
+++ b/include/fuse_common.h
@@ -64,8 +64,11 @@ struct fuse_file_info {
May only be set in ->release(). */
unsigned int flock_release : 1;
+ /* Kill suid and sgid bits on write */
+ unsigned int write_kill_priv : 1;
+
/** Padding. Do not use*/
- unsigned int padding : 27;
+ unsigned int padding : 26;
/** File handle. May be filled in by filesystem in open().
Available in all other file operations */
--- a/include/fuse_kernel.h
+++ b/include/fuse_kernel.h
@@ -304,9 +304,11 @@ struct fuse_file_lock {
*
* FUSE_WRITE_CACHE: delayed write from page cache, file handle is guessed
* FUSE_WRITE_LOCKOWNER: lock_owner field is valid
+ * FUSE_WRITE_KILL_PRIV: kill suid and sgid bits
*/
#define FUSE_WRITE_CACHE (1 << 0)
#define FUSE_WRITE_LOCKOWNER (1 << 1)
+#define FUSE_WRITE_KILL_PRIV (1 << 2)
/**
* Read flags
--- a/lib/fuse_lowlevel.c
+++ b/lib/fuse_lowlevel.c
@@ -1315,12 +1315,14 @@ static void do_write(fuse_req_t req, fus
memset(&fi, 0, sizeof(fi));
fi.fh = arg->fh;
- fi.writepage = (arg->write_flags & 1) != 0;
+ fi.writepage = (arg->write_flags & FUSE_WRITE_CACHE) != 0;
+ fi.write_kill_priv = (arg->write_flags & FUSE_WRITE_KILL_PRIV) != 0;
if (req->se->conn.proto_minor < 9) {
param = ((char *) arg) + FUSE_COMPAT_WRITE_IN_SIZE;
} else {
- fi.lock_owner = arg->lock_owner;
+ if (arg->write_flags & FUSE_WRITE_LOCKOWNER)
+ fi.lock_owner = arg->lock_owner;
fi.flags = arg->flags;
param = PARAM(arg);
}
@@ -1345,7 +1347,8 @@ static void do_write_buf(fuse_req_t req,
memset(&fi, 0, sizeof(fi));
fi.fh = arg->fh;
- fi.writepage = arg->write_flags & 1;
+ fi.writepage = (arg->write_flags & FUSE_WRITE_CACHE) != 0;
+ fi.write_kill_priv = (arg->write_flags & FUSE_WRITE_KILL_PRIV) != 0;
if (se->conn.proto_minor < 9) {
bufv.buf[0].mem = ((char *) arg) + FUSE_COMPAT_WRITE_IN_SIZE;
@@ -1353,7 +1356,8 @@ static void do_write_buf(fuse_req_t req,
FUSE_COMPAT_WRITE_IN_SIZE;
assert(!(bufv.buf[0].flags & FUSE_BUF_IS_FD));
} else {
- fi.lock_owner = arg->lock_owner;
+ if (arg->write_flags & FUSE_WRITE_LOCKOWNER)
+ fi.lock_owner = arg->lock_owner;
fi.flags = arg->flags;
if (!(bufv.buf[0].flags & FUSE_BUF_IS_FD))
bufv.buf[0].mem = PARAM(arg);
[-- Attachment #3: passthrough_ll-kill-suid.patch --]
[-- Type: text/plain, Size: 1824 bytes --]
---
example/passthrough_ll.c | 29 ++++++++++++++++++++++++++++-
1 file changed, 28 insertions(+), 1 deletion(-)
--- a/example/passthrough_ll.c
+++ b/example/passthrough_ll.c
@@ -56,6 +56,7 @@
#include <sys/file.h>
#include <sys/xattr.h>
#include <sys/syscall.h>
+#include <sys/capability.h>
/* We are re-using pointers to our `struct lo_inode` and `struct
lo_dirp` elements as inodes. This means that we must be able to
@@ -965,6 +966,11 @@ static void lo_write_buf(fuse_req_t req,
(void) ino;
ssize_t res;
struct fuse_bufvec out_buf = FUSE_BUFVEC_INIT(fuse_buf_size(in_buf));
+ struct __user_cap_header_struct cap_hdr = {
+ .version = _LINUX_CAPABILITY_VERSION_1,
+ };
+ struct __user_cap_data_struct cap_orig;
+ struct __user_cap_data_struct cap_new;
out_buf.buf[0].flags = FUSE_BUF_IS_FD | FUSE_BUF_FD_SEEK;
out_buf.buf[0].fd = fi->fh;
@@ -974,7 +980,28 @@ static void lo_write_buf(fuse_req_t req,
fprintf(stderr, "lo_write(ino=%" PRIu64 ", size=%zd, off=%lu)\n",
ino, out_buf.buf[0].size, (unsigned long) off);
+ if (fi->write_kill_priv) {
+ res = capget(&cap_hdr, &cap_orig);
+ if (res == -1) {
+ fuse_reply_err(req, errno);
+ return;
+ }
+ cap_new = cap_orig;
+ cap_new.effective &= ~(1 << CAP_FSETID);
+ res = capset(&cap_hdr, &cap_new);
+ if (res == -1) {
+ fuse_reply_err(req, errno);
+ return;
+ }
+ }
+
res = fuse_buf_copy(&out_buf, in_buf, 0);
+
+ if (fi->write_kill_priv) {
+ if (capset(&cap_hdr, &cap_orig) != 0)
+ abort();
+ }
+
if(res < 0)
fuse_reply_err(req, -res);
else
@@ -1215,7 +1242,7 @@ static void lo_copy_file_range(fuse_req_
res = copy_file_range(fi_in->fh, &off_in, fi_out->fh, &off_out, len,
flags);
if (res < 0)
- fuse_reply_err(req, -errno);
+ fuse_reply_err(req, errno);
else
fuse_reply_write(req, res);
}
next prev parent reply other threads:[~2019-05-20 14:44 UTC|newest]
Thread overview: 52+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-05-15 19:26 [PATCH v2 00/30] [RFC] virtio-fs: shared file system for virtual machines Vivek Goyal
2019-05-15 19:26 ` [PATCH v2 01/30] fuse: delete dentry if timeout is zero Vivek Goyal
2019-05-15 19:26 ` [PATCH v2 02/30] fuse: Clear setuid bit even in cache=never path Vivek Goyal
2019-05-20 14:41 ` Miklos Szeredi
2019-05-20 14:44 ` Miklos Szeredi [this message]
2019-05-20 20:25 ` Nikolaus Rath
2019-05-21 15:01 ` Vivek Goyal
2019-05-15 19:26 ` [PATCH v2 03/30] fuse: Use default_file_splice_read for direct IO Vivek Goyal
2019-05-15 19:26 ` [PATCH v2 04/30] fuse: export fuse_end_request() Vivek Goyal
2019-05-15 19:26 ` [PATCH v2 05/30] fuse: export fuse_len_args() Vivek Goyal
2019-05-15 19:26 ` [PATCH v2 06/30] fuse: Export fuse_send_init_request() Vivek Goyal
2019-05-15 19:26 ` [PATCH v2 07/30] fuse: export fuse_get_unique() Vivek Goyal
2019-05-15 19:26 ` [PATCH v2 08/30] fuse: extract fuse_fill_super_common() Vivek Goyal
2019-05-15 19:26 ` [PATCH v2 09/30] fuse: add fuse_iqueue_ops callbacks Vivek Goyal
2019-05-15 19:26 ` [PATCH v2 10/30] fuse: Separate fuse device allocation and installation in fuse_conn Vivek Goyal
2019-05-15 19:26 ` [PATCH v2 11/30] virtio_fs: add skeleton virtio_fs.ko module Vivek Goyal
2019-05-15 19:26 ` [PATCH v2 12/30] dax: remove block device dependencies Vivek Goyal
2019-05-16 0:21 ` Dan Williams
2019-05-16 10:07 ` Stefan Hajnoczi
2019-05-16 14:23 ` Vivek Goyal
2019-05-15 19:26 ` [PATCH v2 13/30] dax: Pass dax_dev to dax_writeback_mapping_range() Vivek Goyal
2019-05-15 19:26 ` [PATCH v2 14/30] virtio: Add get_shm_region method Vivek Goyal
2019-05-15 19:27 ` [PATCH v2 15/30] virtio: Implement get_shm_region for PCI transport Vivek Goyal
2019-05-15 19:27 ` [PATCH v2 16/30] virtio: Implement get_shm_region for MMIO transport Vivek Goyal
2019-05-15 19:27 ` [PATCH v2 17/30] fuse, dax: add fuse_conn->dax_dev field Vivek Goyal
2019-05-15 19:27 ` [PATCH v2 18/30] virtio_fs, dax: Set up virtio_fs dax_device Vivek Goyal
2019-07-17 17:27 ` Halil Pasic
2019-07-18 9:04 ` Cornelia Huck
2019-07-18 11:20 ` Halil Pasic
2019-07-18 14:47 ` Cornelia Huck
2019-07-18 13:15 ` Vivek Goyal
2019-07-18 14:30 ` Dan Williams
2019-07-22 10:51 ` Christian Borntraeger
2019-07-22 10:56 ` Dr. David Alan Gilbert
2019-07-22 11:20 ` Christian Borntraeger
2019-07-22 11:43 ` Cornelia Huck
2019-07-22 12:00 ` Christian Borntraeger
2019-07-22 12:08 ` David Hildenbrand
2019-07-29 13:20 ` Stefan Hajnoczi
2019-05-15 19:27 ` [PATCH v2 19/30] fuse: Keep a list of free dax memory ranges Vivek Goyal
2019-05-15 19:27 ` [PATCH v2 20/30] fuse: Introduce setupmapping/removemapping commands Vivek Goyal
2019-05-15 19:27 ` [PATCH v2 21/30] fuse, dax: Implement dax read/write operations Vivek Goyal
2019-05-15 19:27 ` [PATCH v2 22/30] fuse, dax: add DAX mmap support Vivek Goyal
2019-05-15 19:27 ` [PATCH v2 23/30] fuse: Define dax address space operations Vivek Goyal
2019-05-15 19:27 ` [PATCH v2 24/30] fuse, dax: Take ->i_mmap_sem lock during dax page fault Vivek Goyal
2019-05-15 19:27 ` [PATCH v2 25/30] fuse: Maintain a list of busy elements Vivek Goyal
2019-05-15 19:27 ` [PATCH v2 26/30] fuse: Add logic to free up a memory range Vivek Goyal
[not found] ` <CAN+Pk99SNKSf+GjSQUUWt_eu1fSjTy_ByUOEQUXHi8zNqXY1zA@mail.gmail.com>
2019-05-20 12:53 ` Vivek Goyal
2019-05-15 19:27 ` [PATCH v2 27/30] fuse: Release file in process context Vivek Goyal
2019-05-15 19:27 ` [PATCH v2 28/30] fuse: Reschedule dax free work if too many EAGAIN attempts Vivek Goyal
2019-05-15 19:27 ` [PATCH v2 29/30] fuse: Take inode lock for dax inode truncation Vivek Goyal
2019-05-15 19:27 ` [PATCH v2 30/30] virtio-fs: Do not provide abort interface in fusectl Vivek Goyal
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190520144437.GB24093@localhost.localdomain \
--to=miklos@szeredi.hu \
--cc=dgilbert@redhat.com \
--cc=kvm@vger.kernel.org \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-nvdimm@lists.01.org \
--cc=stefanha@redhat.com \
--cc=swhiteho@redhat.com \
--cc=vgoyal@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).