All of
 help / color / mirror / Atom feed
From: Aleksa Sarai <>
To: Simon Ser <>
Cc: "" <>,
	"" <>
Subject: Re: procfs: open("/proc/self/fd/...") allows bypassing O_RDONLY
Date: Thu, 26 May 2022 23:09:52 +1000	[thread overview]
Message-ID: <20220526130952.z5efngrnh7xtli32@senku> (raw)
In-Reply-To: <>

[-- Attachment #1: Type: text/plain, Size: 2097 bytes --]

On 2022-05-12, Simon Ser <> wrote:
> Hi all,
> I'm a user-space developer working on Wayland. Recently we've been
> discussing about security considerations related to FD passing between
> processes [1].
> A Wayland compositor often needs to share read-only data with its
> clients. Examples include a keyboard keymap, or a pixel format table.
> The clients might be untrusted. The data sharing can happen by having
> the compositor send a read-only FD (ie, a FD opened with O_RDONLY) to
> clients.
> It was assumed that passing such a FD wouldn't allow Wayland clients to
> write to the file. However, it was recently discovered that procfs
> allows to bypass this restriction. A process can open(2)
> "/proc/self/fd/<fd>" with O_RDWR, and that will return a FD suitable for
> writing. This also works when running the client inside a user namespace.
> A PoC is available at [2] and can be tested inside a compositor which
> uses this O_RDONLY strategy (e.g. wlroots compositors).
> Question: is this intended behavior, or is this an oversight? If this is
> intended behavior, what would be a good way to share a FD to another
> process without allowing it to write to the underlying file?

This is currently intended behaviour, but I am working on a patchset to
fix it. This was originally meant to be included with openat2(2) along
with some other hardenings in order to add safe O_EMPTYPATH support (as
well as having the ability for you to open an O_PATH descriptor and
restrict how it can be re-opened).

The WIP patchset is in my repo[1]. The main issue at the moment is how
to deal with directories (for parity with *at(2) semantics as well as
our own sanity, using a /proc/self/fd/$n as a path component can't be
blocked so there's some more access mode fiddling necessary to make this
all cleaner). I should have an RFC version ready in a couple of weeks.


Aleksa Sarai
Senior Software Engineer (Containers)
SUSE Linux GmbH

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 228 bytes --]

      parent reply	other threads:[~2022-05-26 13:10 UTC|newest]

Thread overview: 11+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2022-05-12 10:37 procfs: open("/proc/self/fd/...") allows bypassing O_RDONLY Simon Ser
2022-05-12 12:30 ` Amir Goldstein
2022-05-12 12:38   ` Simon Ser
2022-05-13  9:36     ` Amir Goldstein
2022-05-16  7:51     ` Rasmus Villemoes
2022-05-12 12:41 ` Simon Ser
2022-05-12 12:56   ` Miklos Szeredi
2022-05-13  9:58     ` Christian Brauner
2022-05-26 13:03       ` Aleksa Sarai
2022-05-26 11:08 ` Pavel Machek
2022-05-26 13:09 ` Aleksa Sarai [this message]

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20220526130952.z5efngrnh7xtli32@senku \ \ \ \ \

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.