Bugtraq mailing list archives
Re: /proc filesystem allows bypassing directory permissions on Linux
From: Dan Yefimov <dan () lightwave net ru>
Date: Tue, 27 Oct 2009 02:54:05 +0300
On 26.10.2009 23:05, Isara Beaumont wrote:
Dan Yefimov said:I do not think mounting /proc should change access control semantics.It didn't in fact change anything. If the guest created hardlink to that file in a unrestricted location, what would you say? Procfs is in that respect just another sort of hardlinks, whether you like that or not. If you didn't in fact restrict an access to the file, you're on your own.(1) This is WRONG, and I find it interesting that nobody bothered to check or test this. The POSIX standard mandates that link() shall fail if the user has no search permission for any of the directories in the path prefix of oldpath or newpath. Therefore, setting the directory permission to 0700 protects from hardlink creation (read that again!) and this bug in the /proc filesystem indeed lead to a change in access control semantics. Under POSIX, the file IS unwriteable, because it is protected by the permissions on the parent directory. (2) While it's irrelevant for his argument, the script by Pavel Machek has a race condition. The 'chmod 700 /tmp/my_priv' should be done before the file is created, not afterwards. Otherwise there is a window where the file exists, but hardlink creation is not prevented by the directory permissions.
Your (2) contradicts to (1) and confirms what I told, if you didn't notice that. -- Sincerely Your, Dan.
Current thread:
- Re: /proc filesystem allows bypassing directory permissions on Linux, (continued)
- Re: /proc filesystem allows bypassing directory permissions on Linux Glynn Clements (Oct 29)
- Re: /proc filesystem allows bypassing directory permissions on Linux psz (Oct 27)
- Re: /proc filesystem allows bypassing directory permissions on Linux Pavel Machek (Oct 27)
- Re: Re: /proc filesystem allows bypassing directory permissions on Linux nomail (Oct 26)
- Re: /proc filesystem allows bypassing directory permissions on Linux Kinzel, David (Oct 26)
- Re: /proc filesystem allows bypassing directory permissions on Linux Dan Yefimov (Oct 26)
- Re: /proc filesystem allows bypassing directory permissions on Linux Dan Yefimov (Oct 27)