From: Aleksa Sarai <email@example.com> To: Al Viro <firstname.lastname@example.org>, Jeff Layton <email@example.com>, "J. Bruce Fields" <firstname.lastname@example.org>, Arnd Bergmann <email@example.com>, David Howells <firstname.lastname@example.org> Cc: Aleksa Sarai <email@example.com>, Eric Biederman <firstname.lastname@example.org>, Andy Lutomirski <email@example.com>, Jann Horn <firstname.lastname@example.org>, Christian Brauner <email@example.com>, David Drysdale <firstname.lastname@example.org>, email@example.com, firstname.lastname@example.org, email@example.com, Aleksa Sarai <firstname.lastname@example.org>, email@example.com, firstname.lastname@example.org Subject: [PATCH v4 0/4] namei: O_* flags to restrict path resolution Date: Tue, 13 Nov 2018 01:26:50 +1100 [thread overview] Message-ID: <email@example.com> (raw) Sorry for not sending a series earlier, I've been busy with assignments. Patch changelog: v4: * Remove AT_* flag reservations, as they require more discussion. * Switch to path_is_under() over __d_path() for breakout checking. * Make O_XDEV no longer block openat("/tmp", "/", O_XDEV) -- dirfd is now ignored for absolute paths to match other flags. * Improve the dirfd_path_init() refactor and move it to a separate commit. * Remove reference to Linux-capsicum. * Switch "proclink" name to "magic link". v3: [resend] v2: * Made ".." resolution with AT_THIS_ROOT and AT_BENEATH safe(r) with some semi-aggressive __d_path checking (see patch 3). * Disallowed "proclinks" with AT_THIS_ROOT and AT_BENEATH, in the hopes they can be re-enabled once safe. * Removed the selftests as they will be reimplemented as xfstests. * Removed stat(2) support, since you can already get it through O_PATH and fstatat(2). The need for some sort of control over VFS's path resolution (to avoid malicious paths resulting in inadvertent breakouts) has been a very long-standing desire of many userspace applications. This patchset is a revival of Al Viro's old AT_NO_JUMPS[1,2] patchset (which was a variant of David Drysdale's O_BENEATH patchset which was a spin-off of the Capsicum project) with a few additions and changes made based on the previous discussion within  as well as others I felt were useful. In line with the conclusions of the original discussion of AT_NO_JUMPS, the flag has been split up into separate flags: * O_XDEV blocks all mountpoint crossings (upwards, downwards, or through absolute links). Absolute pathnames alone in openat(2) do not trigger this. * O_NOMAGICLINKS blocks resolution through /proc/$pid/fd-style links. This is done by blocking the usage of nd_jump_link() during resolution in a filesystem. The term "magic links" is used to match with the only reference to these links in Documentation/, but I'm happy to change the name. It should be noted that this is different to the scope of O_NOFOLLOW in that it applies to all path components. However, you can do open(O_NOFOLLOW|O_NOMAGICLINKS|O_PATH) on a "magic link" and it will *not* fail (assuming that no parent component was a "magic link"), and you will have an fd for the "magic link". * O_BENEATH disallows escapes to outside the starting dirfd's tree, using techniques such as ".." or absolute links. Absolute paths in openat(2) are also disallowed. Conceptually this flag is to ensure you "stay below" a certain point in the filesystem tree -- but this requires some additional to protect against various races that would allow escape using ".." (see patch 4 for more detail). Currently O_BENEATH implies O_NOMAGICLINKS, because it can trivially beam you around the filesystem (breaking the protection). In future, there might be similar safety checks as in patch 4, but that requires more discussion. In addition, two new flags were added that expand on the above ideas: * O_NOSYMLINKS does what it says on the tin. No symlink resolution is allowed at all, including "magic links". Just as with O_NOMAGICLINKS this can still be used with (O_PATH|O_NOFOLLOW) to open an fd for the symlink as long as no parent path had a symlink component. * O_THISROOT is an extension of O_BENEATH that, rather than blocking attempts to move past the root, forces all such movements to be scoped to the starting point. This provides chroot(2)-like protection but without the cost of a chroot(2) for each filesystem operation, as well as being safe against race attacks that chroot(2) is not. If a race is detected (as with O_BENEATH) then an error is generated, and similar to O_BENEATH it is not permitted to cross "magic links" with O_THISROOT. The primary need for this is from container runtimes, which currently need to do symlink scoping in userspace when opening paths in a potentially malicious container. There is a long list of CVEs that could have bene mitigated by having O_THISROOT (such as CVE-2017-1002101, CVE-2017-1002102, CVE-2018-15664, to name a few). Cc: Al Viro <firstname.lastname@example.org> Cc: Eric Biederman <email@example.com> Cc: Andy Lutomirski <firstname.lastname@example.org> Cc: David Howells <email@example.com> Cc: Jann Horn <firstname.lastname@example.org> Cc: Christian Brauner <email@example.com> Cc: David Drysdale <firstname.lastname@example.org> Cc: <email@example.com> Cc: <firstname.lastname@example.org> Cc: <email@example.com> : https://lwn.net/Articles/721443/ : https://lore.kernel.org/patchwork/patch/784221/ : https://lwn.net/Articles/619151/ : https://lwn.net/Articles/603929/ : https://lwn.net/Articles/723057/ : https://github.com/cyphar/filepath-securejoin Aleksa Sarai (4): namei: split out nd->dfd handling to dirfd_path_init namei: O_BENEATH-style path resolution flags namei: O_THISROOT: chroot-like path resolution namei: aggressively check for nd->root escape on ".." resolution fs/fcntl.c | 2 +- fs/namei.c | 205 ++++++++++++++++++++++--------- fs/open.c | 13 +- include/linux/fcntl.h | 3 +- include/linux/namei.h | 8 ++ include/uapi/asm-generic/fcntl.h | 20 +++ 6 files changed, 189 insertions(+), 62 deletions(-) -- 2.19.1
next reply other threads:[~2018-11-12 14:27 UTC|newest] Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top 2018-11-12 14:26 Aleksa Sarai [this message] 2018-11-12 14:26 ` [PATCH v4 1/4] namei: split out nd->dfd handling to dirfd_path_init Aleksa Sarai 2018-11-12 14:26 ` [PATCH v4 2/4] namei: O_BENEATH-style path resolution flags Aleksa Sarai 2018-11-23 12:10 ` Jürg Billeter 2018-11-23 16:07 ` Andy Lutomirski 2018-11-23 16:48 ` Aleksa Sarai 2018-11-23 16:52 ` Aleksa Sarai 2018-11-23 16:58 ` Aleksa Sarai 2018-11-12 14:26 ` [PATCH v4 3/4] namei: O_THISROOT: chroot-like path resolution Aleksa Sarai 2018-11-12 14:26 ` [PATCH v4 4/4] namei: aggressively check for nd->root escape on ".." resolution Aleksa Sarai
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --firstname.lastname@example.org \ --email@example.com \ --firstname.lastname@example.org \ --email@example.com \ --firstname.lastname@example.org \ --email@example.com \ --firstname.lastname@example.org \ --email@example.com \ --firstname.lastname@example.org \ --email@example.com \ --firstname.lastname@example.org \ --email@example.com \ --firstname.lastname@example.org \ --email@example.com \ --firstname.lastname@example.org \ --email@example.com \ --firstname.lastname@example.org \ --email@example.com \ --subject='Re: [PATCH v4 0/4] namei: O_* flags to restrict path resolution' \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: link
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).