From mboxrd@z Thu Jan 1 00:00:00 1970 X-Msuck: nntp://news.gmane.org/gmane.linux.lib.musl.general/6957 Path: news.gmane.org!not-for-mail From: Rich Felker Newsgroups: gmane.linux.lib.musl.general Subject: Re: realpath() and setfsuid programs Date: Sat, 7 Feb 2015 11:04:57 -0500 Message-ID: <20150207160457.GY23507@brightrain.aerifal.cx> References: <20150207095354.620d2fe5@vostro> <20150207122603.GU23507@brightrain.aerifal.cx> <20150207123243.GV23507@brightrain.aerifal.cx> <20150207162829.3cdfa036@vostro> Reply-To: musl@lists.openwall.com NNTP-Posting-Host: plane.gmane.org Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Trace: ger.gmane.org 1423325114 5873 80.91.229.3 (7 Feb 2015 16:05:14 GMT) X-Complaints-To: usenet@ger.gmane.org NNTP-Posting-Date: Sat, 7 Feb 2015 16:05:14 +0000 (UTC) To: musl@lists.openwall.com Original-X-From: musl-return-6970-gllmg-musl=m.gmane.org@lists.openwall.com Sat Feb 07 17:05:14 2015 Return-path: Envelope-to: gllmg-musl@m.gmane.org Original-Received: from mother.openwall.net ([195.42.179.200]) by plane.gmane.org with smtp (Exim 4.69) (envelope-from ) id 1YK7sd-0004Ms-SC for gllmg-musl@m.gmane.org; Sat, 07 Feb 2015 17:05:12 +0100 Original-Received: (qmail 20006 invoked by uid 550); 7 Feb 2015 16:05:10 -0000 Mailing-List: contact musl-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: Original-Received: (qmail 19998 invoked from network); 7 Feb 2015 16:05:09 -0000 Content-Disposition: inline In-Reply-To: <20150207162829.3cdfa036@vostro> User-Agent: Mutt/1.5.21 (2010-09-15) Original-Sender: Rich Felker Xref: news.gmane.org gmane.linux.lib.musl.general:6957 Archived-At: On Sat, Feb 07, 2015 at 04:28:29PM +0200, Timo Teras wrote: > > > Why is the check not simply an ownership check for the mount point? > > > I suspect it has to do with the need to pass a pathname rather than > > > fd to mount, which is subject to renaming/moving races, but the > > > realpath call would be subject to the same and worse. Presumably > > > the correct way to do this is to open a fd to the mountpoint then > > > pass /proc/self/fd/%d to the mount function after checking > > > ownership. > > > > Or of course just using chdir and checking ownership of ".". > > Agreed. In this case fuse seems to be the place needing fix. Dropping > privileges just for realpath() does not sound like the right approach. > > Though, I'm wondering if the issue showing up in other places -- that > is realpath() failing if fs uid is set to something that cannot > read /proc/self/fd/... realpath can fail for various reasons, like lacking permissions to a path component, fd exhaustion or other resource issues, etc. so I don't think it's a big deal for it to fail when /proc/self/fd/%d is not accessible. It's not a robust operation to begin with. Rich