Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1757865AbaGAS6T (ORCPT ); Tue, 1 Jul 2014 14:58:19 -0400 Received: from mail-wi0-f179.google.com ([209.85.212.179]:41573 "EHLO mail-wi0-f179.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754264AbaGAS6R (ORCPT ); Tue, 1 Jul 2014 14:58:17 -0400 MIME-Version: 1.0 In-Reply-To: <20140701095356.GC2242@google.com> References: <1404124096-21445-1-git-send-email-drysdale@google.com> <1404124096-21445-2-git-send-email-drysdale@google.com> <87mwcuw2pj.fsf@tassilo.jf.intel.com> <20140701095356.GC2242@google.com> Date: Tue, 1 Jul 2014 22:58:16 +0400 Message-ID: Subject: Re: [PATCH 01/11] fs: add O_BENEATH_ONLY flag to openat(2) From: Loganaden Velvindron To: David Drysdale Cc: Andi Kleen , linux-security-module@vger.kernel.org, linux-kernel@vger.kernel.org, Greg Kroah-Hartman , Alexander Viro , Meredydd Luff , Kees Cook , James Morris , linux-api@vger.kernel.org Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Tue, Jul 1, 2014 at 1:53 PM, David Drysdale wrote: > On Mon, Jun 30, 2014 at 01:40:40PM -0700, Andi Kleen wrote: >> David Drysdale writes: >> >> > Add a new O_BENEATH_ONLY flag for openat(2) which restricts the >> > provided path, rejecting (with -EACCES) paths that are not beneath >> > the provided dfd. In particular, reject: >> > - paths that contain .. components >> > - paths that begin with / >> > - symlinks that have paths as above. >> >> How about bind mounts? >> >> -Andi >> >> -- >> ak@linux.intel.com -- Speaking for myself only > > Bind mounts won't get rejected because they just look like normal > path components. In other words, if dir/subdir is a bind mount to > /root/dir then: > fd = openat(AT_FDCWD, "dir/subdir", O_RDONLY|O_BENEATH_ONLY); > will work fine. Talking about David's efforts at porting Capsicum to Linux, I've already implemented support for Capsicum in OpenSSH. It shouldn't be complicated to enable it on Linux systems that support it. I would very like to see capsicum integrated into mainline, as it's a high quality sandbox solution, that will benefit a lot of server software that implement privilege separation. > -- > To unsubscribe from this list: send the line "unsubscribe linux-security-module" in > the body of a message to majordomo@vger.kernel.org > More majordomo info at http://vger.kernel.org/majordomo-info.html -- This message is strictly personal and the opinions expressed do not represent those of my employers, either past or present. -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/