From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755216AbcGTUn0 (ORCPT ); Wed, 20 Jul 2016 16:43:26 -0400 Received: from mail-pa0-f67.google.com ([209.85.220.67]:34293 "EHLO mail-pa0-f67.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753259AbcGTUnW (ORCPT ); Wed, 20 Jul 2016 16:43:22 -0400 From: Andrey Vagin To: linux-fsdevel@vger.kernel.org, Alexander Viro Cc: linux-kernel@vger.kernel.org, linux-api@vger.kernel.org, containers@lists.linux-foundation.org, criu@openvz.org, Andrey Vagin , "Eric W. Biederman" , Arnd Bergmann , "J. Bruce Fields" , Miklos Szeredi , NeilBrown , Shuah Khan , Omar Sandoval Subject: [PATCH 0/3 v3] fs: allow to use dirfd as root for openat and other *at syscalls Date: Wed, 20 Jul 2016 13:42:54 -0700 Message-Id: <1469047377-13128-1-git-send-email-avagin@openvz.org> X-Mailer: git-send-email 2.5.5 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org The problem is that a pathname can contain absolute symlinks and now they are resolved relative to the current root. It may be a problem if you want to open a file in another namespace. For example, you open /proc/PID/root for a process from the target namespace and then you use openat() to open a file from this namespace. If a path to the file contains an absolute symlink, you will open a file from the current namespace, because a symlink will be resolved relative to the current root. A proposed solution adds a new flag which means that dirfd should be set as a root for a current system call (openat(), statat(), etc). Here are examples how we can open a file in a contex of another process. How we can do this without these changes: old_root = open("/", O_PATH); old_cwd = open(".", O_PATH); chroot("/proc/PID/root"); fd = open(pathname, O_RDONLY); fchdir(old_root); /* emulate fchroot() */ chroot("."); fchdir(old_cwd); close(old_cwd); close(old_root); How this code is simplified with new flags: dirfd = open("/proc/PID/root", O_PATH); fd = open(dirfd, pathname, O_RDONLY | O_ATROOT); close(dirfd); One more thing is that chroot isn't available for unprivileged users. We met this problem, when we tryed to dump an ubuntu container and failed to resolve /proc/PID/root/var/run/mysqld/mysqld.sock, because /var/run was a symlink to /run. Changes since the first version: - change a value of O_ATROOT to not intersect with other constants. Changes since the second version: - initialize nd->root_seq (thanks to Omar Sandoval for reporting and fixing this issue) Cc: Alexander Viro Cc: "Eric W. Biederman" Cc: Arnd Bergmann Cc: "J. Bruce Fields" Cc: Miklos Szeredi Cc: NeilBrown Cc: Shuah Khan Cc: Omar Sandoval Signed-off-by: Andrey Vagin Andrey Vagin (3): namei: add LOOKUP_DFD_ROOT to use dfd as root fs: allow to use dirfd as root for openat and other *at syscalls selftests: check O_ATROOT and AT_FDROOT flags fs/exec.c | 4 +- fs/namei.c | 42 +++++++++++---- fs/open.c | 6 ++- fs/stat.c | 4 +- fs/utimes.c | 4 +- include/linux/namei.h | 2 + include/uapi/asm-generic/fcntl.h | 4 ++ include/uapi/linux/fcntl.h | 1 + tools/testing/selftests/Makefile | 1 + tools/testing/selftests/lookup/.gitignore | 1 + tools/testing/selftests/lookup/Makefile | 8 +++ tools/testing/selftests/lookup/lookup_at_root.c | 71 +++++++++++++++++++++++++ tools/testing/selftests/lookup/run.sh | 14 +++++ 13 files changed, 148 insertions(+), 14 deletions(-) create mode 100644 tools/testing/selftests/lookup/.gitignore create mode 100644 tools/testing/selftests/lookup/Makefile create mode 100644 tools/testing/selftests/lookup/lookup_at_root.c create mode 100755 tools/testing/selftests/lookup/run.sh -- 2.5.5