musl - realpath() and setfsuid programs

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Sat, 7 Feb 2015 09:53:54 +0200
From: Timo Teras <timo.teras@....fi>
To: musl@...ts.openwall.com
Subject: realpath() and setfsuid programs

Hi,

It seems realpath() does not work in binaries using setfsuid(). (At
least on grsec kernels, vanilla kernel might be affected too.)

The problem is that realpath() opens the file, and then
uses just readlink on /proc/self/fd/<fd> to read the canonicalized
path.

However, /proc/self/fd is not accessible if setfsuid() has been used to
drop privileges.

The problem I'm looking at in this case is fuse. fusermount, the
suid wrapper to do user fuse mounts, seems to basically do:
 oldfsuid = setfsuid(getuid())
 oldfsgid = setfsgid(getgid())
 take realpath of mountpoint
 chdir("/")
 setfsuid(oldfsuid)
 setfsgid(oldfsgid)

I believe they want to drop privileges so it works as also access check
to the mount point directory. As realpath() in practice checks that the
user has access to the entry too.

This works glibc, as realpath() canonicalizes the path
component-by-component in userland. But musl breaks due to the /proc
not being accessible while privileges dropped.

Any suggestions?

Thanks,
Timo

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.