From mboxrd@z Thu Jan 1 00:00:00 1970 From: Andy Lutomirski Subject: Re: [PATCH 0/3] namei: implement various scoping AT_* flags Date: Sat, 29 Sep 2018 07:25:57 -0700 Message-ID: <1EE20CA2-4C8B-4A80-B613-0277D92B376D@amacapital.net> References: <20180929103453.12025-1-cyphar@cyphar.com> Mime-Version: 1.0 (1.0) Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: quoted-printable Return-path: In-Reply-To: <20180929103453.12025-1-cyphar@cyphar.com> Sender: linux-kernel-owner@vger.kernel.org To: Aleksa Sarai Cc: Jeff Layton , "J. Bruce Fields" , Al Viro , Arnd Bergmann , Shuah Khan , David Howells , Andy Lutomirski , Christian Brauner , Eric Biederman , Tycho Andersen , linux-kernel@vger.kernel.org, linux-fsdevel@vger.kernel.org, linux-arch@vger.kernel.org, linux-kselftest@vger.kernel.org, dev@opencontainers.org, containers@lists.linux-foundation.org List-Id: linux-arch.vger.kernel.org > On Sep 29, 2018, at 3:34 AM, Aleksa Sarai wrote: >=20 > The need for some sort of control over VFS's path resolution (to avoid > malicious paths resulting in inadvertent breakouts) has been a very > long-standing desire of many userspace applications. This patchset is a > revival of Al Viro's old AT_NO_JUMPS[1] patchset with a few additions. >=20 > The most obvious change is that AT_NO_JUMPS has been split as dicussed > in the original thread, along with a further split of AT_NO_PROCLINKS > which means that each individual property of AT_NO_JUMPS is now a > separate flag: >=20 > * Path-based escapes from the starting-point using "/" or ".." are > blocked by AT_BENEATH. Seems useful. > * Mountpoint crossings are blocked by AT_XDEV. Seems useful. > * /proc/$pid/fd/$fd resolution is blocked by AT_NO_PROCLINKS (more > correctly it actually blocks any user of nd_jump_link() because it > allows out-of-VFS path resolution manipulation). >=20 So how do I disable following symlinks? ISTM the most natural way would be t= o have AT_NO_SYMLINKS, and to have that flag disable proc links.= From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-pf1-f196.google.com ([209.85.210.196]:37858 "EHLO mail-pf1-f196.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728290AbeI2Uyh (ORCPT ); Sat, 29 Sep 2018 16:54:37 -0400 Received: by mail-pf1-f196.google.com with SMTP id x26-v6so6209870pfn.4 for ; Sat, 29 Sep 2018 07:25:59 -0700 (PDT) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (1.0) Subject: Re: [PATCH 0/3] namei: implement various scoping AT_* flags From: Andy Lutomirski In-Reply-To: <20180929103453.12025-1-cyphar@cyphar.com> Date: Sat, 29 Sep 2018 07:25:57 -0700 Content-Transfer-Encoding: quoted-printable Message-ID: <1EE20CA2-4C8B-4A80-B613-0277D92B376D@amacapital.net> References: <20180929103453.12025-1-cyphar@cyphar.com> Sender: linux-arch-owner@vger.kernel.org List-ID: To: Aleksa Sarai Cc: Jeff Layton , "J. Bruce Fields" , Al Viro , Arnd Bergmann , Shuah Khan , David Howells , Andy Lutomirski , Christian Brauner , Eric Biederman , Tycho Andersen , linux-kernel@vger.kernel.org, linux-fsdevel@vger.kernel.org, linux-arch@vger.kernel.org, linux-kselftest@vger.kernel.org, dev@opencontainers.org, containers@lists.linux-foundation.org Message-ID: <20180929142557.cIhDUk6yNI2t7EQvA2wW4hgqfqfUPSuzOyEAJWzyt-4@z> > On Sep 29, 2018, at 3:34 AM, Aleksa Sarai wrote: >=20 > The need for some sort of control over VFS's path resolution (to avoid > malicious paths resulting in inadvertent breakouts) has been a very > long-standing desire of many userspace applications. This patchset is a > revival of Al Viro's old AT_NO_JUMPS[1] patchset with a few additions. >=20 > The most obvious change is that AT_NO_JUMPS has been split as dicussed > in the original thread, along with a further split of AT_NO_PROCLINKS > which means that each individual property of AT_NO_JUMPS is now a > separate flag: >=20 > * Path-based escapes from the starting-point using "/" or ".." are > blocked by AT_BENEATH. Seems useful. > * Mountpoint crossings are blocked by AT_XDEV. Seems useful. > * /proc/$pid/fd/$fd resolution is blocked by AT_NO_PROCLINKS (more > correctly it actually blocks any user of nd_jump_link() because it > allows out-of-VFS path resolution manipulation). >=20 So how do I disable following symlinks? ISTM the most natural way would be t= o have AT_NO_SYMLINKS, and to have that flag disable proc links.=