From mboxrd@z Thu Jan 1 00:00:00 1970 X-Msuck: nntp://news.gmane.org/gmane.linux.lib.musl.general/6956 Path: news.gmane.org!not-for-mail From: Timo Teras Newsgroups: gmane.linux.lib.musl.general Subject: Re: realpath() and setfsuid programs Date: Sat, 7 Feb 2015 16:28:29 +0200 Message-ID: <20150207162829.3cdfa036@vostro> References: <20150207095354.620d2fe5@vostro> <20150207122603.GU23507@brightrain.aerifal.cx> <20150207123243.GV23507@brightrain.aerifal.cx> Reply-To: musl@lists.openwall.com NNTP-Posting-Host: plane.gmane.org Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit X-Trace: ger.gmane.org 1423319357 15721 80.91.229.3 (7 Feb 2015 14:29:17 GMT) X-Complaints-To: usenet@ger.gmane.org NNTP-Posting-Date: Sat, 7 Feb 2015 14:29:17 +0000 (UTC) Cc: musl@lists.openwall.com To: Rich Felker Original-X-From: musl-return-6969-gllmg-musl=m.gmane.org@lists.openwall.com Sat Feb 07 15:29:16 2015 Return-path: Envelope-to: gllmg-musl@m.gmane.org Original-Received: from mother.openwall.net ([195.42.179.200]) by plane.gmane.org with smtp (Exim 4.69) (envelope-from ) id 1YK6Nl-00056n-GU for gllmg-musl@m.gmane.org; Sat, 07 Feb 2015 15:29:13 +0100 Original-Received: (qmail 13544 invoked by uid 550); 7 Feb 2015 14:29:11 -0000 Mailing-List: contact musl-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: Original-Received: (qmail 13536 invoked from network); 7 Feb 2015 14:29:11 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=sender:date:from:to:cc:subject:message-id:in-reply-to:references :mime-version:content-type:content-transfer-encoding; bh=LUOBmqiVaVitDcP2vkLhCLUrq9ct7Cn9YFFy4yKAhh8=; b=F6usjQqg1Q8G0WFink3WHg0TUjhqms8xGDZp74o9frGvsZmmGOoyz2DiT55KUMuIFD RgH7+0RpLUuE84wUUXiDzxHTyUll6QVMuw8zY3f2zubJzbJxpby6sjgc7Z+PAZTuNWPZ RPwdhpdEHAETAlsGrzLnpMb0KIPhNuwtWMQ79rUjI7da3uszgRtlh5QfPFO3RsVsCe8o wcxconMOFwu+gvEC7jQ9DafAALXSy5r8vrxotIMV6D/zdsLRTps0/KmZpsvZaK95QaXN b3ZPkDXTxW3989OusKmsewP6O11msxNvkYeBvwe9LSDln2w5rskcPtc7kLgivKURUhsO iIjA== X-Received: by 10.112.151.228 with SMTP id ut4mr7787644lbb.77.1423319340040; Sat, 07 Feb 2015 06:29:00 -0800 (PST) Original-Sender: =?UTF-8?Q?Timo_Ter=C3=A4s?= In-Reply-To: <20150207123243.GV23507@brightrain.aerifal.cx> X-Mailer: Claws Mail 3.11.1 (GTK+ 2.24.25; x86_64-alpine-linux-musl) Xref: news.gmane.org gmane.linux.lib.musl.general:6956 Archived-At: On Sat, 7 Feb 2015 07:32:43 -0500 Rich Felker wrote: > On Sat, Feb 07, 2015 at 07:26:03AM -0500, Rich Felker wrote: > > On Sat, Feb 07, 2015 at 09:53:54AM +0200, Timo Teras wrote: > > > I believe they want to drop privileges so it works as also access > > > check to the mount point directory. As realpath() in practice > > > checks that the user has access to the entry too. > > > > Could you clarify what you think the security intent of this code > > is? As far as I can tell it's nonsense. realpath is not usable for > > much of anything security-related; in particular, it's non-atomic > > and subject to all sorts of trickery involving renaming/moving > > directories during its operation, even moreso when it's done > > component-by-component in userspace. > > > > Why is the check not simply an ownership check for the mount point? > > I suspect it has to do with the need to pass a pathname rather than > > fd to mount, which is subject to renaming/moving races, but the > > realpath call would be subject to the same and worse. Presumably > > the correct way to do this is to open a fd to the mountpoint then > > pass /proc/self/fd/%d to the mount function after checking > > ownership. > > Or of course just using chdir and checking ownership of ".". Agreed. In this case fuse seems to be the place needing fix. Dropping privileges just for realpath() does not sound like the right approach. Though, I'm wondering if the issue showing up in other places -- that is realpath() failing if fs uid is set to something that cannot read /proc/self/fd/... /Timo