Re: [PATCH 0/2] vfs: ensure that dentries are revalidated on open (try #2)

[Jeff Layton <jlayton@redhat.com>]

On Wed, 18 Nov 2009 18:38:17 +0100
Pavel Machek <pavel@ucw.cz> wrote:

> Hi!
> 
> > > > This is the second attempt to fix this problem. The first one attempted
> > > > to fix this in procfs, but Eric Biederman pointed out that file bind
> > > > mounts have a similar problem. This set attempts to fix the issue at a
> > > > higher level, in the generic VFS layer.
> > > > 
> > > > In certain situations, when it knows that they are valid, the path
> > > > walking code will skip revalidating dentries that it finds in the cache.
> > > > This causes problems with filesystems such as NFSv4 and CIFS that depend
> > > > on the d_revalidate routine to do opens during lookup.
> > > 
> > > ...and it allows bypassing directory permissions. Could we fix both
> > > here?
> > 
> > Does it? Here's what I just did to check that:
> 
> Yes it does, see http://seclists.org/bugtraq/2009/Oct/179
> 
> 
> > # cp /bin/sleep /root/sleep
> > 
> > # ls -l /root /root/sleep
> > dr-xr-x---. 19 root root  4096 2009-11-18 07:20 /root
> > -rwxr-xr-x.  1 root root 29152 2009-11-18 07:20 /root/sleep
> > 
> > # /root/sleep 600
> > 
> > ...then as unprivileged user:
> > 
> > $ ps -ef | grep sleep 
> > (find pid of sleep program that root is running)
> > 
> > $ /proc/5258/exe 600
> > bash: /proc/5258/exe: Permission denied
> > 
> > ...it looks like directory permissions are respected here. Did I
> > misunderstand what you're concerned about?
> 
> /proc does not allow you to use /proc/XX/fd of unrelated users; it is
> another mechanism disallowing access. (Plus, I did my experiments with
> /proc/XX/fd, not /exe).
> 									Pavel

Thanks for the info. Took me a while to get through it but I read most
of the thread. I agree that it sounds like a very similar problem.

I'm beginning to wonder whether the right answer is to just make
these /proc symlinks behave more like normal symlinks. Get rid of
LAST_BIND and have follow_link turn the dentry into a path via d_path().

It's less efficient, but it means less special-casing in the path
walking code. I don't see /proc symlinks as being so performance
critical that we can't do it that way instead.

That still leaves the issue with bind mounted files not causing a
d_revalidate, but we can deal with that separately once the other issue
is resolved...

Thoughts?
-- 
Jeff Layton <jlayton@redhat.com>