diff options
| author | Aleksa Sarai <cyphar@cyphar.com> | 2019-12-07 01:13:32 +1100 |
|---|---|---|
| committer | Al Viro <viro@zeniv.linux.org.uk> | 2019-12-08 19:09:41 -0500 |
| commit | 72ba29297e1439efaa54d9125b866ae9d15df339 (patch) | |
| tree | 9b59a51822c4319657e486b71b6bf44b2ab952ef /include/linux/namei.h | |
| parent | 4b99d4996979d582859c5a49072e92de124bf691 (diff) | |
| download | linux-stable-72ba29297e1439efaa54d9125b866ae9d15df339.tar.gz linux-stable-72ba29297e1439efaa54d9125b866ae9d15df339.tar.bz2 linux-stable-72ba29297e1439efaa54d9125b866ae9d15df339.zip | |
namei: LOOKUP_NO_XDEV: block mountpoint crossing
/* Background. */
The need to contain path operations within a mountpoint has been a
long-standing usecase that userspace has historically implemented
manually with liberal usage of stat(). find, rsync, tar and
many other programs implement these semantics -- but it'd be much
simpler to have a fool-proof way of refusing to open a path if it
crosses a mountpoint.
This is part of a refresh of Al's AT_NO_JUMPS patchset[1] (which was a
variation on David Drysdale's O_BENEATH patchset[2], which in turn was
based on the Capsicum project[3]).
/* Userspace API. */
LOOKUP_NO_XDEV will be exposed to userspace through openat2(2).
/* Semantics. */
Unlike most other LOOKUP flags (most notably LOOKUP_FOLLOW),
LOOKUP_NO_XDEV applies to all components of the path.
With LOOKUP_NO_XDEV, any path component which crosses a mount-point
during path resolution (including "..") will yield an -EXDEV. Absolute
paths, absolute symlinks, and magic-links will only yield an -EXDEV if
the jump involved changing mount-points.
/* Testing. */
LOOKUP_NO_XDEV is tested as part of the openat2(2) selftests.
[1]: https://lore.kernel.org/lkml/20170429220414.GT29622@ZenIV.linux.org.uk/
[2]: https://lore.kernel.org/lkml/1415094884-18349-1-git-send-email-drysdale@google.com/
[3]: https://lore.kernel.org/lkml/1404124096-21445-1-git-send-email-drysdale@google.com/
Cc: Christian Brauner <christian.brauner@ubuntu.com>
Suggested-by: David Drysdale <drysdale@google.com>
Suggested-by: Al Viro <viro@zeniv.linux.org.uk>
Suggested-by: Andy Lutomirski <luto@kernel.org>
Suggested-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Aleksa Sarai <cyphar@cyphar.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Diffstat (limited to 'include/linux/namei.h')
| -rw-r--r-- | include/linux/namei.h | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/include/linux/namei.h b/include/linux/namei.h index f8acec81cf03..edb4562b5c4e 100644 --- a/include/linux/namei.h +++ b/include/linux/namei.h @@ -42,6 +42,7 @@ enum {LAST_NORM, LAST_ROOT, LAST_DOT, LAST_DOTDOT, LAST_BIND}; /* Scoping flags for lookup. */ #define LOOKUP_NO_SYMLINKS 0x010000 /* No symlink crossing. */ #define LOOKUP_NO_MAGICLINKS 0x020000 /* No nd_jump_link() crossing. */ +#define LOOKUP_NO_XDEV 0x040000 /* No mountpoint crossing. */ extern int path_pts(struct path *path); |