summaryrefslogtreecommitdiffstats
path: root/include/linux/namei.h
diff options
context:
space:
mode:
authorAleksa Sarai <cyphar@cyphar.com>2019-12-07 01:13:32 +1100
committerAl Viro <viro@zeniv.linux.org.uk>2019-12-08 19:09:41 -0500
commit72ba29297e1439efaa54d9125b866ae9d15df339 (patch)
tree9b59a51822c4319657e486b71b6bf44b2ab952ef /include/linux/namei.h
parent4b99d4996979d582859c5a49072e92de124bf691 (diff)
downloadlinux-stable-72ba29297e1439efaa54d9125b866ae9d15df339.tar.gz
linux-stable-72ba29297e1439efaa54d9125b866ae9d15df339.tar.bz2
linux-stable-72ba29297e1439efaa54d9125b866ae9d15df339.zip
namei: LOOKUP_NO_XDEV: block mountpoint crossing
/* Background. */ The need to contain path operations within a mountpoint has been a long-standing usecase that userspace has historically implemented manually with liberal usage of stat(). find, rsync, tar and many other programs implement these semantics -- but it'd be much simpler to have a fool-proof way of refusing to open a path if it crosses a mountpoint. This is part of a refresh of Al's AT_NO_JUMPS patchset[1] (which was a variation on David Drysdale's O_BENEATH patchset[2], which in turn was based on the Capsicum project[3]). /* Userspace API. */ LOOKUP_NO_XDEV will be exposed to userspace through openat2(2). /* Semantics. */ Unlike most other LOOKUP flags (most notably LOOKUP_FOLLOW), LOOKUP_NO_XDEV applies to all components of the path. With LOOKUP_NO_XDEV, any path component which crosses a mount-point during path resolution (including "..") will yield an -EXDEV. Absolute paths, absolute symlinks, and magic-links will only yield an -EXDEV if the jump involved changing mount-points. /* Testing. */ LOOKUP_NO_XDEV is tested as part of the openat2(2) selftests. [1]: https://lore.kernel.org/lkml/20170429220414.GT29622@ZenIV.linux.org.uk/ [2]: https://lore.kernel.org/lkml/1415094884-18349-1-git-send-email-drysdale@google.com/ [3]: https://lore.kernel.org/lkml/1404124096-21445-1-git-send-email-drysdale@google.com/ Cc: Christian Brauner <christian.brauner@ubuntu.com> Suggested-by: David Drysdale <drysdale@google.com> Suggested-by: Al Viro <viro@zeniv.linux.org.uk> Suggested-by: Andy Lutomirski <luto@kernel.org> Suggested-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Aleksa Sarai <cyphar@cyphar.com> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Diffstat (limited to 'include/linux/namei.h')
-rw-r--r--include/linux/namei.h1
1 files changed, 1 insertions, 0 deletions
diff --git a/include/linux/namei.h b/include/linux/namei.h
index f8acec81cf03..edb4562b5c4e 100644
--- a/include/linux/namei.h
+++ b/include/linux/namei.h
@@ -42,6 +42,7 @@ enum {LAST_NORM, LAST_ROOT, LAST_DOT, LAST_DOTDOT, LAST_BIND};
/* Scoping flags for lookup. */
#define LOOKUP_NO_SYMLINKS 0x010000 /* No symlink crossing. */
#define LOOKUP_NO_MAGICLINKS 0x020000 /* No nd_jump_link() crossing. */
+#define LOOKUP_NO_XDEV 0x040000 /* No mountpoint crossing. */
extern int path_pts(struct path *path);