Commit 05045329 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge branch 'work.sane_pwd' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 

Pull misc vfs updates from Al Viro:
 "Making sure that something like a referral point won't end up as pwd
  or root.

  The main part is the last commit (fixing mntns_install()); that one
  fixes a hard-to-hit race. The fchdir() commit is making fchdir(2) a
  bit more robust - it should be impossible to get opened files (even
  O_PATH ones) for referral points in the first place, so the existing
  checks are OK, but checking the same thing as in chdir(2) is just as
  cheap.

  The path_init() commit removes a redundant check that shouldn't have
  been there in the first place"

* 'work.sane_pwd' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
  make sure that mntns_install() doesn't end up with referral for root
  path_init(): don't bother with checking MAY_EXEC for LOOKUP_ROOT
  make sure that fchdir() won't accept referral points, etc.
parents e0c4a5fc 4f757f3c

fs/namei.c

+40 −8
Original line number Diff line number Diff line
@@ -2142,7 +2142,6 @@ OK: 


static const char *path_init(struct nameidata *nd, unsigned flags)

{

	int retval = 0;

	const char *s = nd->name->name;



	if (!*s)
@@ -2154,13 +2153,8 @@ static const char *path_init(struct nameidata *nd, unsigned flags) 
	if (flags & LOOKUP_ROOT) {

		struct dentry *root = nd->root.dentry;

		struct inode *inode = root->d_inode;

		if (*s) {

			if (!d_can_lookup(root))

		if (*s && unlikely(!d_can_lookup(root)))

			return ERR_PTR(-ENOTDIR);

			retval = inode_permission(inode, MAY_EXEC);

			if (retval)

				return ERR_PTR(retval);

		}

		nd->path = nd->root;

		nd->inode = inode;

		if (flags & LOOKUP_RCU) {
@@ -2258,6 +2252,35 @@ static inline int lookup_last(struct nameidata *nd) 
	return walk_component(nd, 0);

}



static int handle_lookup_down(struct nameidata *nd)

{

	struct path path = nd->path;

	struct inode *inode = nd->inode;

	unsigned seq = nd->seq;

	int err;



	if (nd->flags & LOOKUP_RCU) {

		/*

		 * don't bother with unlazy_walk on failure - we are

		 * at the very beginning of walk, so we lose nothing

		 * if we simply redo everything in non-RCU mode

		 */

		if (unlikely(!__follow_mount_rcu(nd, &path, &inode, &seq)))

			return -ECHILD;

	} else {

		dget(path.dentry);

		err = follow_managed(&path, nd);

		if (unlikely(err < 0))

			return err;

		inode = d_backing_inode(path.dentry);

		seq = 0;

	}

	path_to_nameidata(&path, nd);

	nd->inode = inode;

	nd->seq = seq;

	return 0;

}



/* Returns 0 and nd will be valid on success; Retuns error, otherwise. */

static int path_lookupat(struct nameidata *nd, unsigned flags, struct path *path)

{
@@ -2266,6 +2289,15 @@ static int path_lookupat(struct nameidata *nd, unsigned flags, struct path *path 


	if (IS_ERR(s))

		return PTR_ERR(s);



	if (unlikely(flags & LOOKUP_DOWN)) {

		err = handle_lookup_down(nd);

		if (unlikely(err < 0)) {

			terminate_walk(nd);

			return err;

		}

	}



	while (!(err = link_path_walk(s, nd))

		&& ((err = lookup_last(nd)) > 0)) {

		s = trailing_symlink(nd);

fs/namespace.c

+11 −7
Original line number Diff line number Diff line
@@ -3462,8 +3462,9 @@ static void mntns_put(struct ns_common *ns) 
static int mntns_install(struct nsproxy *nsproxy, struct ns_common *ns)

{

	struct fs_struct *fs = current->fs;

	struct mnt_namespace *mnt_ns = to_mnt_ns(ns);

	struct mnt_namespace *mnt_ns = to_mnt_ns(ns), *old_mnt_ns;

	struct path root;

	int err;



	if (!ns_capable(mnt_ns->user_ns, CAP_SYS_ADMIN) ||

	    !ns_capable(current_user_ns(), CAP_SYS_CHROOT) ||
@@ -3474,15 +3475,18 @@ static int mntns_install(struct nsproxy *nsproxy, struct ns_common *ns) 
		return -EINVAL;



	get_mnt_ns(mnt_ns);

	put_mnt_ns(nsproxy->mnt_ns);

	old_mnt_ns = nsproxy->mnt_ns;

	nsproxy->mnt_ns = mnt_ns;



	/* Find the root */

	root.mnt    = &mnt_ns->root->mnt;

	root.dentry = mnt_ns->root->mnt.mnt_root;

	path_get(&root);

	while(d_mountpoint(root.dentry) && follow_down_one(&root))

		;

	err = vfs_path_lookup(mnt_ns->root->mnt.mnt_root, &mnt_ns->root->mnt,

				"/", LOOKUP_DOWN, &root);

	if (err) {

		/* revert to old namespace */

		nsproxy->mnt_ns = old_mnt_ns;

		put_mnt_ns(mnt_ns);

		return err;

	}



	/* Update the pwd and root */

	set_fs_pwd(fs, &root);

fs/open.c

+3 −6
Original line number Diff line number Diff line
@@ -460,20 +460,17 @@ out: 
SYSCALL_DEFINE1(fchdir, unsigned int, fd)

{

	struct fd f = fdget_raw(fd);

	struct inode *inode;

	int error = -EBADF;

	int error;



	error = -EBADF;

	if (!f.file)

		goto out;



	inode = file_inode(f.file);



	error = -ENOTDIR;

	if (!S_ISDIR(inode->i_mode))

	if (!d_can_lookup(f.file->f_path.dentry))

		goto out_putf;



	error = inode_permission(inode, MAY_EXEC | MAY_CHDIR);

	error = inode_permission(file_inode(f.file), MAY_EXEC | MAY_CHDIR);

	if (!error)

		set_fs_pwd(current->fs, &f.file->f_path);

out_putf:

include/linux/namei.h

+1 −0
Original line number Diff line number Diff line
@@ -44,6 +44,7 @@ enum {LAST_NORM, LAST_ROOT, LAST_DOT, LAST_DOTDOT, LAST_BIND}; 
#define LOOKUP_JUMPED		0x1000

#define LOOKUP_ROOT		0x2000

#define LOOKUP_EMPTY		0x4000

#define LOOKUP_DOWN		0x8000



extern int path_pts(struct path *path);

CRA Git | Maintained and supported by SUSTech CRA and CCSE