[RFD] A mount api that notices previous mounts

* [RFD] A mount api that notices previous mounts
@ 2019-01-29 21:44 Eric W. Biederman
  2019-01-29 23:01 ` Casey Schaufler
                   ` (3 more replies)
  0 siblings, 4 replies; 14+ messages in thread
From: Eric W. Biederman @ 2019-01-29 21:44 UTC (permalink / raw)
  To: linux-api
  Cc: linux-fsdevel, linux-kernel, Al Viro, David Howells,
	Miklos Szeredi, Linus Torvalds, Karel Zak, util-linux,
	Andy Lutomirski

[-- Attachment #1: Type: text/plain, Size: 3563 bytes --]

All,

With the existing mount API it is possible to mount a filesystem
like:

mount -t ext4 /dev/sda1 -o user_xattr /some/path
mount -t ext4 /dev/sda1 -o nouser_xattr /some/other/path

And have both mount commands succeed and have two mounts of the same
filesystem.  If the mounter is not attentive or the first mount is added
earlier it may not be immediately noticed that a mount option that is
needed for the correct operation or the security of the system is lost.

We have seen this failure mode with both devpts and proc.  So it is not
theoretical, and it has resulted in CVEs.

In some cases the existing mount API (such as a conflict between ro and
rw) handles this by returning -EBUSY.  So we may be able to correct this
in the existing mount API.  But it is always very tricky to to get
adequate testing for a change like that to avoid regressions, so I am
proposing we change this in the new mount api.

This has been brought up before and I have been told it is technically
infeasible to make this work.  To counter that I have sat down and
implemented it.

The basic idea is:
 - get a handle to a filesystem
   (passing enough options to uniquely identify the super block).
   Also capture enough state in the file handle to let you know if
   the file system has it's mount options changed between system calls.
   (essentially this is just the fs code that calls sget)

 - If the super block has not been configured allow setting the file
   systems options.

 - If the super block has already been configured require reading the
   file systems mount options before setting/updating the file systems
   mount options.

To complement that I have functionality that:
 - Allows reading a file systems current mount options.
 - Allows reading the mount options that are needed to get a handle to
   the filesystem.  For most filesystems it is just the block device
   name.  For nfs is is essentially all mount options.  For btrfs
   it is the block device name, and the "devices=" mount option for
   secondary block device names.

Please find below a tree where all of this is implemented and working.
Not all file systems have been converted but the most of the unconverted
ones are just a couple minutes work as I have converted all of the file
system mount helper routines.

Also please find below an example mount program that takes the same set
of mount options as mount(8) today and mounts filesystems with the
proposed new mount api.
 - Without having any filesystem mount knowledge it sucessfully figures

out which system calls different mount options needs to be applied
   to.

- Without having any filesystem specific knowledge in most cases it
   can detect if a mount option you specify is already specified to an
   existing mount or not.  For duplicates it can detect it ignores them.
   For the other cases it fails the mount as it thinks the mount options
   are different.

 - Which demonstrates it safe to put the detection and remediation of
   multiple mount commands resolving to the same filesystem in user
   space.

I really don't care whose code gets used as long as it works.  I do very
much care that we don't add a new mount api that has the confusion flaws
of the existing mount api.

Along the way I have also detected a lot of room for improvement on the
mount path for filesystems.  Those cleanup patches are in my tree below
and will be extracting them and sending them along shortly.

Comments?

git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace.git no-losing-mount-options-proof-of-concept

[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #2: example_mount.c --]
[-- Type: text/x-csrc, Size: 9637 bytes --]

/* gcc -Wall -O2 -g example_mount.c -o example_mount */
#define _ATFILE_SOURCE
#include <sys/syscall.h>
#include <unistd.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <errno.h>
#include <fcntl.h>
#include <sys/syscall.h>

#ifdef __x86_64__
# ifndef __NR_open_tree
#  define __NR_open_tree 335
# endif
# ifndef __NR_move_mount
#  define __NR_move_mount 336
# endif
# ifndef __NR_fsopen
#  define  __NR_fsopen 337
# endif
# ifndef __NR_fsspecifiers
#  define  __NR_fsspecifiers 338
# endif
# ifndef __NR_fsinstance
#  define  __NR_fsinstance 339
# endif
# ifndef __NR_fspick
#  define  __NR_fspick 340
# endif
# ifndef __NR_fsset
#  define  __NR_fsset 341
# endif
# ifndef __NR_fsmount
#  define  __NR_fsmount 342
# endif
# ifndef __NR_fsoptions
#  define  __NR_fsoptions 343
# endif
# ifndef __NR_fsname
#  define  __NR_fsname 344
# endif
# ifndef __NR_fstype
#  define  __NR_fstype 345
# endif
#endif /* x86_64 */

#ifndef MOVE_MOUNT_F_SYMLINKS
# define MOVE_MOUNT_F_SYMLINKS		0x00000001 /* Follow symlinks on from path */
#endif
#ifndef MOVE_MOUNT_F_AUTOMOUNTS
# define MOVE_MOUNT_F_AUTOMOUNTS	0x00000002 /* Follow automounts on from path */
#endif
#ifndef MOVE_MOUNT_F_EMPTY_PATH
# define MOVE_MOUNT_F_EMPTY_PATH	0x00000004 /* Empty from path permitted */
#endif
#ifndef MOVE_MOUNT_T_SYMLINKS
# define MOVE_MOUNT_T_SYMLINKS		0x00000010 /* Follow symlinks on to path */
#endif
#ifndef MOVE_MOUNT_T_AUTOMOUNTS
# define MOVE_MOUNT_T_AUTOMOUNTS	0x00000020 /* Follow automounts on to path */
#endif
#ifndef MOVE_MOUNT_T_EMPTY_PATH
# define MOVE_MOUNT_T_EMPTY_PATH	0x00000040 /* Empty to path permitted */
#endif

int open_tree(int dfd, const char *path, unsigned int flags)
{
	return syscall(__NR_open_tree, dfd, path, flags);
}

int move_mount(int from_dfd, const char *from_path,
	       int to_dfd, const char *to_path, unsigned int flags)
{
	return syscall(__NR_move_mount, from_dfd, from_path, to_dfd, to_path, flags);
}

int fsopen(const char *type)
{
	return syscall(__NR_fsopen, type);
}

int fsspecifiers(int driverfd, char *specifiers, size_t specifiers_len)
{
	return syscall(__NR_fsspecifiers, driverfd, specifiers, specifiers_len);
}

int fsinstance(int driverfd, const char *name, const char *specifiers)
{
	return syscall(__NR_fsinstance, driverfd, name, specifiers);
}

int fspick(int dfd, const char *path, unsigned int flags)
{
	return syscall(__NR_fspick, dfd, path, flags);
}

int fsset(int instancefd, const char *options)
{
	return syscall(__NR_fsset, instancefd, options);
}

int fsmount(int instancefd, const char *options)
{
	return syscall(__NR_fsmount, instancefd, options);
}

int fsoptions(int instancefd, char *options, size_t options_len)
{
	return syscall(__NR_fsoptions, instancefd, options, options_len);
}

int fsname(int instancefd, char *name, size_t name_len)
{
	return syscall(__NR_fsname, instancefd, name, name_len);
}

int fstype(int instancefd, char *type, size_t type_len)
{
	return syscall(__NR_fstype, instancefd, type, type_len);
}

static const char *mount_vec[] = {
	"ro",
	"rw",
	"nosuid",
	"nodev",
	"dev",
	"noexec",
	"nodiratime",
	"diratime",
	"noatime",
	"relatime",
	"strictatime",
	NULL
};

static const char *joint_vec[] = {
	"ro",
	"rw",
	NULL
};

static char *parse_mnt_opt(char *opt, char *end)
{
	char *p, *equal = NULL;
	int open_quote;

	open_quote = 0;
	for (p = opt; (p < end) && *p; p++) {
		if (equal && (*p == '"'))
			open_quote ^= 1;
		if (open_quote)
			continue;
		if (!equal && (*p == '='))
			equal = p;
		else if (*p == ',') {
			end = p;
			break;
		}
	}
	/* Unbalaned quotes? */
	if (open_quote) {
		errno = -EINVAL;
		return NULL;
	}

	return end;
}

int split_options(char *options, const char ***optvp)
{
	const char **vec = NULL;
	size_t count = 0, index = 0;
	char *opt, *end, *comma;

	opt = options;
	end = opt + strlen(opt);
	for (comma = opt; comma != end; opt = comma + 1) {
		comma = parse_mnt_opt(opt, end);
		if (!comma)
			return -1;

		if (opt == comma)
			continue;

		count++;
	}

	vec = calloc(count + 1, sizeof(char *));
	if (!vec)
		return -1;

	opt = options;
	for (comma = opt; comma != end; opt = comma + 1) {
		comma = parse_mnt_opt(opt, end);
		if (!comma)
			abort();

		if (opt == comma)
			continue;

		*comma = '\0';
		vec[index++] = opt;
	}
	vec[index] = NULL;
	*optvp = vec;
	return 0;
}

static char *join_options(const char *optv[])
{
	char *flat, *flat_opt;
	const char **opt;
	size_t bytes = 0;

	for (opt = optv; *opt; opt++) {
		size_t len = strlen(*opt);
		/* An extra byte for the comma */
		bytes += len + 1;
	}

	flat_opt = flat = malloc(bytes + 1);
	if (!flat) {
		fprintf(stderr, "malloc failed: %s\n", strerror(errno));
		exit(EXIT_FAILURE);
	}

	for (opt = optv; *opt; opt++) {
		size_t len = strlen(*opt);
		if (flat_opt != flat) {
			*flat_opt = ',';
			flat_opt += 1;
		}
		memcpy(flat_opt, *opt, len);
		flat_opt += len;
	}
	*flat_opt = '\0';
	return flat;
}

void build_option_strings(int dfd,
	const char **specifiers, const char **ioptions, const char **moptions,
	const char *input_options)
{
	char accepted_specifiers[1024*1024];
	const char **ovec, **asvec, **svec, **ivec, **mvec;
	const char **opt, **sopt, **iopt, **mopt;
	char *options;
	size_t count;
	int ret;

	ret = fsspecifiers(dfd, accepted_specifiers, sizeof(accepted_specifiers));
	if (ret < 0) {
		fprintf(stderr, "fsspecifiers failed: %s\n", strerror(errno));
		exit(EXIT_FAILURE);
	}

	options = strdup(input_options);
	if (!options) {
		fprintf(stderr, "strdup failed: %s\n", strerror(errno));
		exit(EXIT_FAILURE);
	}
	if (split_options(options, &ovec) != 0) {
		fprintf(stderr, "split_options failed: %s\n", strerror(errno));
		exit(EXIT_FAILURE);
	}
	if (split_options(accepted_specifiers, &asvec) != 0) {
		fprintf(stderr, "split_options failed: %s\n", strerror(errno));
		exit(EXIT_FAILURE);
	}

	for (count = 0, opt = ovec; *opt; opt++) {
		count++;
	}

	svec = calloc(count + 1, sizeof(char *));
	if (!svec) {
		fprintf(stderr, "calloc failed: %s\n", strerror(errno));
		exit(EXIT_FAILURE);
	}
	ivec = calloc(count + 1, sizeof(char *));
	if (!ivec) {
		fprintf(stderr, "calloc failed: %s\n", strerror(errno));
		exit(EXIT_FAILURE);
	}
	mvec = calloc(count + 1, sizeof(char *));
	if (!mvec) {
		fprintf(stderr, "calloc failed: %s\n", strerror(errno));
		exit(EXIT_FAILURE);
	}

	sopt = svec;
	iopt = ivec;
	mopt = mvec;
	for (opt = ovec; *opt; opt++) {
		const char **topt;
		const char *sep;
		int len;

		sep = strchr(*opt, '=');
		len = sep ? sep - *opt : strlen(*opt);

		/* Is the option both a mount an a normal option? */
		for (topt = joint_vec; *topt; topt++) {
			if (strcmp(*opt, *topt) == 0) {
				*mopt++ = *opt;
				goto fsoption;
			}
		}
		/* Is the option just a mount option? */
		for (topt = mount_vec; *topt; topt++) {
			if (strcmp(*opt, *topt) == 0) {
				*mopt++ = *opt;
				goto placed;
			}
		}
	fsoption:
		for (topt = asvec; *topt; topt++) {
			char tail;
			if (strncmp(*opt, *topt, len) != 0)
				continue;
			tail = (*opt)[len];
			if (tail != (sep ? '=' : '\0'))
				continue;
			*sopt++ = *opt;
			goto placed;
		}
		*iopt++ = *opt;
	placed:
		;
	}
	*sopt = NULL;
	*iopt = NULL;
	*mopt = NULL;
	*specifiers = join_options(svec);
	*ioptions = join_options(ivec);
	*moptions = join_options(mvec);
	free(svec);
	free(ivec);
	free(mvec);
	return;
}

int main(int argc, char **argv)
{
	const char *type, *name, *specifiers, *options, *moptions, *dir;
	const char *input_options;
	int dfd, ifd, mfd, ret;

	if (argc != 5) {
		fprintf(stderr, "usage: new_mount <type> <name> <options> <dir>\n");
		return EXIT_FAILURE;
	}

	type = argv[1];
	name = argv[2];
	input_options = argv[3];
	dir = argv[4];

	dfd = fsopen(type);
	if (dfd < 0) {
		fprintf(stderr, "fsopen failed: %s\n", strerror(errno));
		return EXIT_FAILURE;
	}

	build_option_strings(dfd, &specifiers, &options, &moptions, input_options);

	ifd = fsinstance(dfd, name, specifiers);
	if (ifd < 0) {
		fprintf(stderr, "fsinstance failed: %s\n", strerror(errno));
		return EXIT_FAILURE;
	}

	errno = 0;
	ret = fsset(ifd, options);
	if (ret && (errno != ESTALE)) {
		fprintf(stderr, "fsset.1 failed: %s\n", strerror(errno));
		return EXIT_FAILURE;
	}
	if (errno == ESTALE) {
		char existing_options[1024*1024];
		const char **evec, **nvec, **eopt, **nopt;
		char *new_options;
		ret = fsoptions(ifd, existing_options, sizeof(existing_options));
		if (ret < 0) {
			fprintf(stderr, "fsoptions failed: %s\n", strerror(errno));
			return EXIT_FAILURE;
		}

		new_options = strdup(options);
		if (!new_options) {
			fprintf(stderr, "strdup failed: %s\n", strerror(errno));
			return EXIT_FAILURE;
		}
		if (split_options(existing_options, &evec) != 0) {
			fprintf(stderr, "split_options failed: %s\n", strerror(errno));
			return EXIT_FAILURE;
		}
		if (split_options(new_options, &nvec) != 0) {
			fprintf(stderr, "split_options failed: %s\n", strerror(errno));
			return EXIT_FAILURE;
		}
		for (nopt = nvec; *nopt; nopt++) {
			for (eopt = evec; *eopt; eopt++) {
				if (strcmp(*eopt, *nopt) == 0)
					goto found;
			}
			fprintf(stderr, "Setting '%s' would change the existing file system options\n",
				*nopt);
			return EXIT_FAILURE;
		found:
			;
		}
		ret = fsset(ifd, options);
		if (ret) {
			fprintf(stderr, "fsset.2 failed: %s\n", strerror(errno));
			return EXIT_FAILURE;
		}

	}

	mfd = fsmount(ifd, moptions);
	if (mfd < 0) {
		fprintf(stderr, "fsmount failed: %s\n", strerror(errno));
		return EXIT_FAILURE;
	}
	close(ifd);

	ret = move_mount(mfd, "", AT_FDCWD, dir, MOVE_MOUNT_F_EMPTY_PATH);
	if (ret) {
		fprintf(stderr, "move_mount failed: %s\n", strerror(errno));
		return EXIT_FAILURE;
	}

	return 0;
}

[-- Attachment #3: Type: text/plain, Size: 8 bytes --]

Eric

^ permalink raw reply	[flat|nested] 14+ messages in thread