realpath() and setfsuid programs

[Timo Teras <timo.teras@iki.fi>]

Hi,

It seems realpath() does not work in binaries using setfsuid(). (At
least on grsec kernels, vanilla kernel might be affected too.)

The problem is that realpath() opens the file, and then
uses just readlink on /proc/self/fd/<fd> to read the canonicalized
path.

However, /proc/self/fd is not accessible if setfsuid() has been used to
drop privileges.

The problem I'm looking at in this case is fuse. fusermount, the
suid wrapper to do user fuse mounts, seems to basically do:
 oldfsuid = setfsuid(getuid())
 oldfsgid = setfsgid(getgid())
 take realpath of mountpoint
 chdir("/")
 setfsuid(oldfsuid)
 setfsgid(oldfsgid)

I believe they want to drop privileges so it works as also access check
to the mount point directory. As realpath() in practice checks that the
user has access to the entry too.

This works glibc, as realpath() canonicalizes the path
component-by-component in userland. But musl breaks due to the /proc
not being accessible while privileges dropped.

Any suggestions?

Thanks,
Timo