bugThe GNU Hurd - Bugs: bug #26960, firmlink opens target with client...

 
 

bug #26960: firmlink opens target with client specified flags

Submitter:  Carl Fredrik Hammar <hammy>
Submitted:  Sat 04 Jul 2009 04:05:50 PM UTC
   
 
Category:  Hurd Servers Severity:  3 - Normal
Priority:  5 - Normal Item Group:  None
Status:  None Privacy:  Public
Assigned to:  None Originator Name: 
Open/Closed:  Open Reproducibility:  None
Size (loc):  None Planned Release:  None
Effort:  0.00
Wiki-like text discussion box: 


* Mandatory Fields

Add a New Comment Rich Markup
   

Tue 20 Sep 2016 10:54:09 PM UTC, comment #1: 

Someone should write test cases for whether the patch causes problems with the following flags.

  • O_APPEND: Open a firmlink with O_APPEND and then use io_get_openmodes and verify that the O_APPEND bit is there.
  • O_NOATIME: Open a firmlink with O_NOATIME, use io_read, close the file_t and check that the atime of the target file remains unchanged.
  • O_NONBLOCK
  • O_ASYNC
  • others?


If the firmlink translator doesn't pass O_APPEND to the dir_lookup call, but its caller ends up doing another dir_lookup and setting O_APPEND there, then it's okay, provided that the RPC responses from the firmlink translator are such that the caller cannot expect the file_t to work right if it omits the second dir_lookup.

 Kalle Olavi Niemitalo <kon>
Sat 04 Jul 2009 04:05:50 PM UTC, original submission:  

firmlink opens its target file with any client specified open
flags, except O_CREAT.  This makes it is possible for a client
to read or write to the target of a firmlink using the firmlink's
authority (io_restrict_auth is not enough).  It is also possible
for the client to halt firmlink's look-up midway through, using
O_NOLINK and O_NOTRANS.

A patch that fixes it has been attached.  Also a program that
exploits the security-hole, just run it on a firmlink to a target
that it should not be permitted to read.

Carl Fredrik Hammar <hammy>
Group Member

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files
file #18367:  0001-Don-t-pass-client-flags-to-internal-firmlink-look-up.patch added by hammy (1KiB - text/x-diff)
file #18368:  firmlink-read.c added by hammy (757B - text/x-csrc)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by kon (Posted a comment)
  • -email is unavailable- added by hammy (Submitted the item)

    •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 2 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2009-07-04 hammy Attached File- Added 0001-Don-t-pass-client-flags-to-internal-firmlink-look-up.patch, #18367
        Attached File- Added firmlink-read.c, #18368

    Back to the top

    Copyright © 2025 Free Software Foundation, Inc.
    Verbatim copying and distribution of this entire article is permitted in any medium, provided this notice is preserved.
    The Levitating, Meditating, Flute-playing Gnu logo is a GNU GPL'ed image provided by the Nevrax Design Team.
    Page source code

    Powered by Savane 3.14-04e1.
    Corresponding source code