Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932343AbcJNOzY (ORCPT ); Fri, 14 Oct 2016 10:55:24 -0400 Received: from zeniv.linux.org.uk ([195.92.253.2]:50974 "EHLO ZenIV.linux.org.uk" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932238AbcJNOzR (ORCPT ); Fri, 14 Oct 2016 10:55:17 -0400 Date: Fri, 14 Oct 2016 15:55:15 +0100 From: Al Viro To: Mattias Nissler Cc: linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org Subject: Re: [RFC] [PATCH] Add a "nolinks" mount option. Message-ID: <20161014145515.GA19539@ZenIV.linux.org.uk> References: <1476455305-35554-1-git-send-email-mnissler@chromium.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <1476455305-35554-1-git-send-email-mnissler@chromium.org> User-Agent: Mutt/1.7.0 (2016-08-17) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1598 Lines: 27 On Fri, Oct 14, 2016 at 04:28:25PM +0200, Mattias Nissler wrote: > For mounts that have the new "nolinks" option, don't follow symlinks > and reject to open files with a hard link count larger than one. The > new option is similar in spirit to the existing "nodev", "noexec", and > "nosuid" options. > > Note that symlinks and hard links may still be created on mounts where > the "nolinks" option is present. readlink() remains functional, so > user space code that is aware of symlinks can still choose to follow > them explicitly. Similarly, hard-linked files can be identified from > userspace using stat() output while the "nolinks" option is set. > > Setting the "nolinks" mount option helps prevent privileged writers > from modifying files unintentionally in case there is an unexpected > link along the accessed path. The "nolinks" option is thus useful as a > defensive measure against persistent exploits (i.e. a system getting > re-exploited after a reboot) for systems that employ a read-only or > dm-verity-protected rootfs. These systems prevent non-legit binaries > from running after reboot. However, legit code typically still reads > from and writes to a writable file system previously under full > control of the attacker, who can place symlinks to trick file writes > after reboot to target a file of their choice. "nolinks" fundamentally > prevents this. Which parts of the tree would be on that "protected" rootfs and which would you mount with that option? Description above is rather vague and I'm not convinced that it actually buys you anything. Details, please...