Re: [PATCH v3 0/7] User namespace mount updates

From	bfields@fieldses.org (J. Bruce Fields)
Newsgroups	linux.kernel
Subject	Re: [PATCH v3 0/7] User namespace mount updates
Date	2015-11-18 19:50 +0100
Message-ID	<qwfXP-6Jq-5@gated-at.bofh.it> (permalink)
References	(1 earlier) <qvRVv-7TO-11@gated-at.bofh.it> <qvSeT-81H-29@gated-at.bofh.it> <qvSHV-8dG-19@gated-at.bofh.it> <qvTND-EM-9@gated-at.bofh.it> <qvUgG-Qn-11@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

On Tue, Nov 17, 2015 at 07:30:12PM +0000, Al Viro wrote:
> On Tue, Nov 17, 2015 at 02:02:09PM -0500, Austin S Hemmelgarn wrote:
> 
> > >_Static_ attacks, or change-image-under-mounted-fs attacks?
> > To properly protect against attacks on mounted filesystems, we'd
> > need some new concept of a userspace immutable file (that is, one
> > where nobody can write to it except the kernel, and only the kernel
> > can change it between regular access and this new state), and then
> > have the kernel set an image (or block device) to this state when a
> > filesystem is mounted from it (this introduces all kinds of other
> > issues too however, for example stuff that allows an online fsck on
> > the device will stop working, as will many un-deletion tools).
> > 
> > The only other option would be to force the FS to cache all metadata
> > in memory, and validate between the cache and what's on disk on
> > every access, which is not realistic for any real world system.
> 
> Doctor, it hurt when I do it...
> 
> IOW, the other option is to refuse attempting this insanity.  Fuse probably
> can be handled, but being able to mount (with kernel-space drivera) an
> arbitrary ext4 image is equivalent to being able to do anything and it's
> going to stay that way for the forseeable future.

What about the filesystems that desktop users commonly mount? (fat,
isofs, udf?)

--b.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Back to linux.kernel | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

[PATCH v3 0/7] User namespace mount updates Seth Forshee <seth.forshee@canonical.com> - 2015-11-17 17:50 +0100
  [PATCH v3 1/7] block_dev: Support checking inode permissions in lookup_bdev() Seth Forshee <seth.forshee@canonical.com> - 2015-11-17 17:50 +0100
  [PATCH v3 2/7] block_dev: Check permissions towards block device inode when mounting Seth Forshee <seth.forshee@canonical.com> - 2015-11-17 17:50 +0100
  [PATCH v3 3/7] mtd: Check permissions towards mtd block device inode when mounting Seth Forshee <seth.forshee@canonical.com> - 2015-11-17 17:50 +0100
  Re: [PATCH v3 0/7] User namespace mount updates Al Viro <viro@ZenIV.linux.org.uk> - 2015-11-17 18:10 +0100
    Re: [PATCH v3 0/7] User namespace mount updates Seth Forshee <seth.forshee@canonical.com> - 2015-11-17 18:30 +0100
      Re: [PATCH v3 0/7] User namespace mount updates "Serge E. Hallyn" <serge@hallyn.com> - 2015-11-17 18:50 +0100
      Re: [PATCH v3 0/7] User namespace mount updates Al Viro <viro@ZenIV.linux.org.uk> - 2015-11-17 19:00 +0100
        Re: [PATCH v3 0/7] User namespace mount updates Seth Forshee <seth.forshee@canonical.com> - 2015-11-17 19:40 +0100
          Re: [PATCH v3 0/7] User namespace mount updates Richard Weinberger <richard.weinberger@gmail.com> - 2015-11-17 20:20 +0100
            Re: [PATCH v3 0/7] User namespace mount updates Octavian Purdila <octavian.purdila@intel.com> - 2015-11-17 20:30 +0100
              Re: [PATCH v3 0/7] User namespace mount updates Richard Weinberger <richard@nod.at> - 2015-11-17 21:20 +0100
                Re: [PATCH v3 0/7] User namespace mount updates Octavian Purdila <octavian.purdila@intel.com> - 2015-11-17 23:10 +0100
                Re: [PATCH v3 0/7] User namespace mount updates Seth Forshee <seth.forshee@canonical.com> - 2015-11-19 16:30 +0100
                Re: [PATCH v3 0/7] User namespace mount updates Octavian Purdila <octavian.purdila@intel.com> - 2015-11-19 17:20 +0100
                Re: [PATCH v3 0/7] User namespace mount updates Seth Forshee <seth.forshee@canonical.com> - 2015-11-19 17:40 +0100
                Re: [PATCH v3 0/7] User namespace mount updates "Serge E. Hallyn" <serge.hallyn@ubuntu.com> - 2015-11-20 18:40 +0100
            Re: [PATCH v3 0/7] User namespace mount updates Richard Weinberger <richard@nod.at> - 2015-11-17 20:30 +0100
            Re: [PATCH v3 0/7] User namespace mount updates Seth Forshee <seth.forshee@canonical.com> - 2015-11-17 20:30 +0100
          Re: [PATCH v3 0/7] User namespace mount updates Theodore Ts'o <tytso@mit.edu> - 2015-11-18 20:20 +0100
            Re: [PATCH v3 0/7] User namespace mount updates Seth Forshee <seth.forshee@canonical.com> - 2015-11-18 20:30 +0100
            Re: [PATCH v3 0/7] User namespace mount updates Serge Hallyn <serge.hallyn@ubuntu.com> - 2015-11-18 20:40 +0100
        Re: [PATCH v3 0/7] User namespace mount updates Austin S Hemmelgarn <ahferroin7@gmail.com> - 2015-11-17 20:10 +0100
          Re: [PATCH v3 0/7] User namespace mount updates Seth Forshee <seth.forshee@canonical.com> - 2015-11-17 20:20 +0100
            Re: [PATCH v3 0/7] User namespace mount updates Austin S Hemmelgarn <ahferroin7@gmail.com> - 2015-11-17 22:00 +0100
              Re: [PATCH v3 0/7] User namespace mount updates Seth Forshee <seth.forshee@canonical.com> - 2015-11-17 22:40 +0100
                Re: [PATCH v3 0/7] User namespace mount updates Austin S Hemmelgarn <ahferroin7@gmail.com> - 2015-11-18 13:30 +0100
                Re: [PATCH v3 0/7] User namespace mount updates Seth Forshee <seth.forshee@canonical.com> - 2015-11-18 15:30 +0100
                Re: [PATCH v3 0/7] User namespace mount updates Al Viro <viro@ZenIV.linux.org.uk> - 2015-11-18 16:00 +0100
                Re: [PATCH v3 0/7] User namespace mount updates Seth Forshee <seth.forshee@canonical.com> - 2015-11-18 16:10 +0100
                Re: [PATCH v3 0/7] User namespace mount updates Al Viro <viro@ZenIV.linux.org.uk> - 2015-11-18 16:20 +0100
                Re: [PATCH v3 0/7] User namespace mount updates Richard Weinberger <richard.weinberger@gmail.com> - 2015-11-18 16:30 +0100
                Re: [PATCH v3 0/7] User namespace mount updates James Morris <jmorris@namei.org> - 2015-11-19 08:50 +0100
                Re: [PATCH v3 0/7] User namespace mount updates Richard Weinberger <richard@nod.at> - 2015-11-19 09:00 +0100
                Re: [PATCH v3 0/7] User namespace mount updates "Serge E. Hallyn" <serge.hallyn@ubuntu.com> - 2015-11-19 15:30 +0100
                Re: [PATCH v3 0/7] User namespace mount updates Richard Weinberger <richard@nod.at> - 2015-11-19 16:10 +0100
                Re: [PATCH v3 0/7] User namespace mount updates Colin Walters <walters@verbum.org> - 2015-11-19 15:40 +0100
                Re: [PATCH v3 0/7] User namespace mount updates Richard Weinberger <richard@nod.at> - 2015-11-19 15:50 +0100
                Re: [PATCH v3 0/7] User namespace mount updates "Richard W.M. Jones" <rjones@redhat.com> - 2015-11-19 16:20 +0100
                Re: [PATCH v3 0/7] User namespace mount updates "Serge E. Hallyn" <serge.hallyn@ubuntu.com> - 2015-11-19 16:00 +0100
                Re: [PATCH v3 0/7] User namespace mount updates Nikolay Borisov <kernel@kyup.com> - 2015-11-18 16:40 +0100
                Re: [PATCH v3 0/7] User namespace mount updates Austin S Hemmelgarn <ahferroin7@gmail.com> - 2015-11-18 16:40 +0100
          Re: [PATCH v3 0/7] User namespace mount updates Al Viro <viro@ZenIV.linux.org.uk> - 2015-11-17 20:40 +0100
            Re: [PATCH v3 0/7] User namespace mount updates Austin S Hemmelgarn <ahferroin7@gmail.com> - 2015-11-17 21:40 +0100
              Re: [PATCH v3 0/7] User namespace mount updates Al Viro <viro@ZenIV.linux.org.uk> - 2015-11-17 22:10 +0100
                Re: [PATCH v3 0/7] User namespace mount updates Seth Forshee <seth.forshee@canonical.com> - 2015-11-17 23:10 +0100
                Re: [PATCH v3 0/7] User namespace mount updates Austin S Hemmelgarn <ahferroin7@gmail.com> - 2015-11-18 13:50 +0100
                Re: [PATCH v3 0/7] User namespace mount updates Seth Forshee <seth.forshee@canonical.com> - 2015-11-18 15:40 +0100
                Re: [PATCH v3 0/7] User namespace mount updates Austin S Hemmelgarn <ahferroin7@gmail.com> - 2015-11-18 16:40 +0100
            Re: [PATCH v3 0/7] User namespace mount updates bfields@fieldses.org (J. Bruce Fields) - 2015-11-18 19:50 +0100

csiph-web