From mboxrd@z Thu Jan 1 00:00:00 1970 X-Msuck: nntp://news.gmane.org/gmane.linux.lib.musl.general/9822 Path: news.gmane.org!not-for-mail From: Rich Felker Newsgroups: gmane.linux.lib.musl.general Subject: Re: AS-safe change for multithreaded setxid breaks chroot() along with set*id() Date: Fri, 1 Apr 2016 21:03:12 -0400 Message-ID: <20160402010311.GB21636@brightrain.aerifal.cx> References: <20160401202249.GB961@lalala> Reply-To: musl@lists.openwall.com NNTP-Posting-Host: plane.gmane.org Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Trace: ger.gmane.org 1459559021 26677 80.91.229.3 (2 Apr 2016 01:03:41 GMT) X-Complaints-To: usenet@ger.gmane.org NNTP-Posting-Date: Sat, 2 Apr 2016 01:03:41 +0000 (UTC) To: musl@lists.openwall.com Original-X-From: musl-return-9835-gllmg-musl=m.gmane.org@lists.openwall.com Sat Apr 02 03:03:36 2016 Return-path: Envelope-to: gllmg-musl@m.gmane.org Original-Received: from mother.openwall.net ([195.42.179.200]) by plane.gmane.org with smtp (Exim 4.69) (envelope-from ) id 1am9yQ-0000Il-8Q for gllmg-musl@m.gmane.org; Sat, 02 Apr 2016 03:03:34 +0200 Original-Received: (qmail 25837 invoked by uid 550); 2 Apr 2016 01:03:32 -0000 Mailing-List: contact musl-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-ID: Original-Received: (qmail 25814 invoked from network); 2 Apr 2016 01:03:31 -0000 Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.21 (2010-09-15) Original-Sender: Rich Felker Xref: news.gmane.org gmane.linux.lib.musl.general:9822 Archived-At: On Fri, Apr 01, 2016 at 08:28:48PM +0000, Josiah Worcester wrote: > On Fri, Apr 1, 2016 at 1:23 PM Lance Chen wrote: > > > Hello there, > > > > I have been trying to run powerdns on Alpine Linux, which features musl, > > without success. It turns out that the AS-safe strategy introduced in > > the patch > > > > http://git.musl-libc.org/cgit/musl/commit/?id=78a8ef47c4d92b7680c52a85f80a81e29da86bb9 > > , > > especially the use of reading /proc/self/task, causes the failure. The > > failure condition is a combination of three features, pthread, chroot, > > and set*id. After chroot()'ing to some directory, calling set*id() will > > try to access /proc/self/task, and fail to find the directory in the new > > root. I've created a minimal POC at > > https://gist.github.com/Lance0312/c7a82793e35b322bfbdfe96b79dd3152. > > A fairly simple fix for this would be to create and mount /proc in the > chroot. This is likely to be needed for some other interfaces in libc as > well as other libraries and utilities, because there's functionality of > Linux which is only really exposed in that filesystem. I don't know of > anything in particular that would fail on glibc, but I am confident that > you'll have issues, just like if you don't have /dev in the chroot. Indeed. Due to Linux limitations, it's impossible to provide complete behavior for some functions without /proc. In the case of set*id, the right solution is to fix the kernel so that it can atomically change the ids of a whole process, but I looked at doing that and it's hard (because of a lot of architectural flaws on the kernel's part, like using an allocated struct cred and RCU mess to represent ids rather than just putting them inline in the task struct). Rich