Re: [PATCH 01/16] devpts: Attempting to get it right

From	ebiederm@xmission.com (Eric W. Biederman)
Newsgroups	linux.kernel
Subject	Re: [PATCH 01/16] devpts: Attempting to get it right
Date	2016-04-15 23:00 +0200
Message-ID	<roj0m-Bj-13@gated-at.bofh.it> (permalink)
References	(14 earlier) <rnaBQ-2QL-11@gated-at.bofh.it> <rnb4R-3n3-5@gated-at.bofh.it> <rnc0W-43s-9@gated-at.bofh.it> <roeal-5jh-5@gated-at.bofh.it> <rof6p-63Q-17@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

Andy Lutomirski <luto@amacapital.net> writes:

> On Fri, Apr 15, 2016 at 8:34 AM, Eric W. Biederman
> <ebiederm@xmission.com> wrote:
>>
>> To recap the situation for those who have not been following closely.
>>
>> There are programs such as xen-create-image that run as root and setup
>> a chroot environment with:
>> "mknod dev/ptmx c 5 2"
>> "mkdir dev/pts"
>> "mount -t devpts none dev/pts"
>>
>> Which mostly works but stomps the mount options of the system /dev/pts.
>> In particular the options of "gid=5,mode=620" are lost resulting in a
>> situation where creating a new pty by opening /dev/ptmx results in
>> that pty having the wrong permissions.
>>
>> Some distributions have been working around this problem by continuing
>> to install a setuid root pt_chown binary that will be called by glibc
>> to fix the permissions.
>>
>> Maintaining a setuid root pt_chown binary is not too scary until
>> multiple instances of devpts are considered at which point it becomes
>> possible to trick the setuid root pt_chown binary into operating on the
>> wrong files and directories.  Leading to all of the things one might
>> fear when a setuid root binary goes wrong.
>>
>> The following patchset digs us out of that hole by carefully devpts and
>> /dev/ptmx in a way that does not introduce any userspace regressions,
>> while making each mount of devpts distinct (so pt_chown is unnecessary)
>> and arranging things so that enough information is available so
>> that a secure pt_chown binary is possible to write if that is ever
>> needed.
>>
>> The approach I have chosen to take is to first enhance the /dev/ptmx
>> device node to automount /dev/pts/ptmx on top of it.  This leads to a
>> simple high performance solution that allows applications such as
>> xen-create-image (that call "mknod ptmx c 5 2" and mount devpts)
>> to continue to run as before even when they are given a non-system
>> instance of devpts.
>>
>> Using automountic bind mounts of /dev/pts/ptmx results in no new
>> security cases to consider as this can already be done, and actually
>> results in a simplification of the analysis of the code.  As now all
>> opens of ptmx are of /dev/pts/ptmx.  /dev/ptmx is now just a magic
>> mountpoint that does the right thing.
>
> And what happens when someone tries to rm /dev/ptmx or unmount their
> pts instance or similar?

Unlink works (that was a trivial extension of the existing semantics).
It really didn't make sense that we honor mounts that can appear and
disappear on their own as much as we honor other mounts.

> What happens if /dev/ptmx is in a mount that
> is set to propagate elsewhere but /dev/pts was replaced by an
> unprivileged user?  (Can this happen?  I'm not sure.)

Well nothing that currently works will break in such a weird scenario.
So I call what happens in the crazy cases you are imagining well defined
obvious semantics (aka all you need to do is to apply the current
rules).  Plus you have to be pretty crazy to do something like that.
Further I am 90% certain that the propogation semantics on the /dev
directory are what define how mounts of /dev/pts and /dev/ptmx
propagate.

> This seems much weirder than the previous approach.  I think I'm
> starting to come over to Linus' view -- the magic lookup was fine, and
> I still can't think of a case where the permissions matter.  If we
> care, we can cause the /dev/ptmx magic lookup to fail if the devpts it
> finds was created with newinstance.  (After all, devpts instances
> created with newinstance *never* worked via /dev/ptmx magic.)

It isn't weirder.  The rules are actually just a little simpler.

That is my take away from playing with it and working with it.  The code
is actually really boring and just works in practice.

But please take my branch and play with it, and see if you can get it to
do something weird and magical.   It is observable enough I don't expect
you can.  But please.  If I am wrong I will happily scrap this.

Right now this looks from my vanrage point like really really obvious
semantics, that don't cause regressions, and that are easy to understand
and observe.

Eric

Thread

[PATCH 00/13] devpts: New instances for every mount ebiederm@xmission.com (Eric W. Biederman) - 2016-04-05 02:20 +0200
  [PATCH 04/13] devpts: Stop rolling devpts_remount by hand in devpts_mount "Eric W. Biederman" <ebiederm@xmission.com> - 2016-04-05 03:50 +0200
  [PATCH 05/13] devpts: Fail early (if appropriate) on overmount "Eric W. Biederman" <ebiederm@xmission.com> - 2016-04-05 03:50 +0200
  [PATCH 08/13] devpts: Make devpts_kill_sb safe if fsi is NULL "Eric W. Biederman" <ebiederm@xmission.com> - 2016-04-05 03:50 +0200
  [PATCH 03/13] devpts: Cleanup newinstance parsing "Eric W. Biederman" <ebiederm@xmission.com> - 2016-04-05 03:50 +0200
  [PATCH 06/13] devpts: Use the same default mode for both /dev/ptmx and dev/pts/ptmx "Eric W. Biederman" <ebiederm@xmission.com> - 2016-04-05 03:50 +0200
  [PATCH 01/13] devpts: Teach /dev/ptmx to find the associated devpts via path lookup "Eric W. Biederman" <ebiederm@xmission.com> - 2016-04-05 03:50 +0200
    [PATCH 09/13] devpts: Move the creation of /dev/pts/ptmx into fill_super "Eric W. Biederman" <ebiederm@xmission.com> - 2016-04-05 03:50 +0200
    [PATCH 02/13] devpts: More obvious check for the system devpts in pty allocation "Eric W. Biederman" <ebiederm@xmission.com> - 2016-04-05 03:50 +0200
    [PATCH 13/13] devpts: Kill the DEVPTS_MULTIPLE_INSTANCE config option "Eric W. Biederman" <ebiederm@xmission.com> - 2016-04-05 03:50 +0200
    [PATCH 07/13] devpts: Move parse_mount_options into fill_super "Eric W. Biederman" <ebiederm@xmission.com> - 2016-04-05 03:50 +0200
    [PATCH 12/13] devpts: Always return a distinct instance when mounting "Eric W. Biederman" <ebiederm@xmission.com> - 2016-04-05 04:00 +0200
    [PATCH 11/13] vfs: Implement mount_super_once "Eric W. Biederman" <ebiederm@xmission.com> - 2016-04-05 04:00 +0200
    [PATCH 10/13] devpts: Simplify devpts_mount by using mount_nodev "Eric W. Biederman" <ebiederm@xmission.com> - 2016-04-05 04:00 +0200
    Re: [PATCH 01/13] devpts: Teach /dev/ptmx to find the associated  devpts via path lookup Al Viro <viro@ZenIV.linux.org.uk> - 2016-04-05 05:00 +0200
      Re: [PATCH 01/13] devpts: Teach /dev/ptmx to find the associated  devpts via path lookup Al Viro <viro@ZenIV.linux.org.uk> - 2016-04-05 05:10 +0200
        Re: [PATCH 01/13] devpts: Teach /dev/ptmx to find the associated devpts via path lookup ebiederm@xmission.com (Eric W. Biederman) - 2016-04-08 21:10 +0200
    Re: [PATCH 01/13] devpts: Teach /dev/ptmx to find the associated  devpts via path lookup Linus Torvalds <torvalds@linux-foundation.org> - 2016-04-07 18:10 +0200
      Re: [PATCH 01/13] devpts: Teach /dev/ptmx to find the associated devpts via path lookup ebiederm@xmission.com (Eric W. Biederman) - 2016-04-08 21:10 +0200
        Re: [PATCH 01/13] devpts: Teach /dev/ptmx to find the associated  devpts via path lookup Linus Torvalds <torvalds@linux-foundation.org> - 2016-04-08 21:10 +0200
          Re: [PATCH 01/13] devpts: Teach /dev/ptmx to find the associated devpts via path lookup ebiederm@xmission.com (Eric W. Biederman) - 2016-04-08 22:20 +0200
          Re: [PATCH 01/13] devpts: Teach /dev/ptmx to find the associated  devpts via path lookup Andy Lutomirski <luto@amacapital.net> - 2016-04-08 22:50 +0200
            Re: [PATCH 01/13] devpts: Teach /dev/ptmx to find the associated devpts via path lookup ebiederm@xmission.com (Eric W. Biederman) - 2016-04-08 23:50 +0200
              Re: [PATCH 01/13] devpts: Teach /dev/ptmx to find the associated  devpts via path lookup Andy Lutomirski <luto@amacapital.net> - 2016-04-09 00:00 +0200
              Re: [PATCH 01/13] devpts: Teach /dev/ptmx to find the associated  devpts via path lookup Linus Torvalds <torvalds@linux-foundation.org> - 2016-04-09 00:00 +0200
                Re: [PATCH 01/13] devpts: Teach /dev/ptmx to find the associated devpts via path lookup ebiederm@xmission.com (Eric W. Biederman) - 2016-04-09 01:20 +0200
        Re: [PATCH 01/13] devpts: Teach /dev/ptmx to find the associated  devpts via path lookup One Thousand Gnomes <gnomes@lxorguk.ukuu.org.uk> - 2016-04-09 15:20 +0200
          Re: [PATCH 01/13] devpts: Teach /dev/ptmx to find the associated devpts via path lookup "H. Peter Anvin" <hpa@zytor.com> - 2016-04-09 16:20 +0200
            Re: [PATCH 01/13] devpts: Teach /dev/ptmx to find the associated devpts via path lookup ebiederm@xmission.com (Eric W. Biederman) - 2016-04-09 17:00 +0200
              Re: [PATCH 01/13] devpts: Teach /dev/ptmx to find the associated devpts via path lookup "H. Peter Anvin" <hpa@zytor.com> - 2016-04-10 00:50 +0200
                Re: [PATCH 01/13] devpts: Teach /dev/ptmx to find the associated  devpts via path lookup Linus Torvalds <torvalds@linux-foundation.org> - 2016-04-10 02:10 +0200
                Re: [PATCH 01/13] devpts: Teach /dev/ptmx to find the associated devpts via path lookup "H. Peter Anvin" <hpa@zytor.com> - 2016-04-10 02:20 +0200
                Re: [PATCH 01/13] devpts: Teach /dev/ptmx to find the associated  devpts via path lookup Linus Torvalds <torvalds@linux-foundation.org> - 2016-04-10 02:20 +0200
                Re: [PATCH 01/13] devpts: Teach /dev/ptmx to find the associated  devpts via path lookup Andy Lutomirski <luto@amacapital.net> - 2016-04-10 02:50 +0200
                Re: [PATCH 01/13] devpts: Teach /dev/ptmx to find the associated devpts via path lookup "H. Peter Anvin" <hpa@zytor.com> - 2016-04-11 17:10 +0200
                Re: [PATCH 01/13] devpts: Teach /dev/ptmx to find the associated  devpts via path lookup Al Viro <viro@ZenIV.linux.org.uk> - 2016-04-12 03:40 +0200
                Re: [PATCH 01/13] devpts: Teach /dev/ptmx to find the associated  devpts via path lookup Andy Lutomirski <luto@amacapital.net> - 2016-04-11 22:20 +0200
                Re: [PATCH 01/13] devpts: Teach /dev/ptmx to find the associated devpts via path lookup "H. Peter Anvin" <hpa@zytor.com> - 2016-04-11 22:30 +0200
                Re: [PATCH 01/13] devpts: Teach /dev/ptmx to find the associated devpts via path lookup ebiederm@xmission.com (Eric W. Biederman) - 2016-04-12 01:50 +0200
                Re: [PATCH 01/13] devpts: Teach /dev/ptmx to find the associated  devpts via path lookup Linus Torvalds <torvalds@linux-foundation.org> - 2016-04-12 02:10 +0200
                Re: [PATCH 01/13] devpts: Teach /dev/ptmx to find the associated devpts via path lookup ebiederm@xmission.com (Eric W. Biederman) - 2016-04-12 02:30 +0200
                Re: [PATCH 01/13] devpts: Teach /dev/ptmx to find the associated  devpts via path lookup Linus Torvalds <torvalds@linux-foundation.org> - 2016-04-12 03:20 +0200
                Re: [PATCH 01/13] devpts: Teach /dev/ptmx to find the associated devpts via path lookup "H. Peter Anvin" <hpa@zytor.com> - 2016-04-12 03:20 +0200
                Re: [PATCH 01/13] devpts: Teach /dev/ptmx to find the associated devpts via path lookup ebiederm@xmission.com (Eric W. Biederman) - 2016-04-12 03:40 +0200
                Re: [PATCH 01/13] devpts: Teach /dev/ptmx to find the associated  devpts via path lookup Al Viro <viro@ZenIV.linux.org.uk> - 2016-04-12 03:50 +0200
                Re: [PATCH 01/13] devpts: Teach /dev/ptmx to find the associated  devpts via path lookup Al Viro <viro@ZenIV.linux.org.uk> - 2016-04-12 03:40 +0200
                Re: [PATCH 01/13] devpts: Teach /dev/ptmx to find the associated devpts via path lookup ebiederm@xmission.com (Eric W. Biederman) - 2016-04-12 04:30 +0200
                Re: [PATCH 01/13] devpts: Teach /dev/ptmx to find the associated devpts via path lookup ebiederm@xmission.com (Eric W. Biederman) - 2016-04-11 22:30 +0200
                Re: [PATCH 01/13] devpts: Teach /dev/ptmx to find the associated  devpts via path lookup Andy Lutomirski <luto@amacapital.net> - 2016-04-12 19:50 +0200
                Re: [PATCH 01/13] devpts: Teach /dev/ptmx to find the associated  devpts via path lookup Linus Torvalds <torvalds@linux-foundation.org> - 2016-04-12 20:20 +0200
                Re: [PATCH 01/13] devpts: Teach /dev/ptmx to find the associated  devpts via path lookup "H. Peter Anvin" <hpa@zytor.com> - 2016-04-12 21:20 +0200
                [PATCH 01/16] devpts: Attempting to get it right ebiederm@xmission.com (Eric W. Biederman) - 2016-04-15 17:50 +0200
                [PATCH 08/16] devpts: Stop rolling devpts_remount by hand in devpts_mount "Eric W. Biederman" <ebiederm@xmission.com> - 2016-04-15 17:50 +0200
                [PATCH 05/16] vfs: Allow unlink, and rename on expirable file mounts "Eric W. Biederman" <ebiederm@xmission.com> - 2016-04-15 17:50 +0200
                [PATCH 04/16] devpts: Teach /dev/ptmx to automount the appropriate devpts via path lookup "Eric W. Biederman" <ebiederm@xmission.com> - 2016-04-15 17:50 +0200
                Re: [PATCH 04/16] devpts: Teach /dev/ptmx to automount the  appropriate devpts via path lookup Jann Horn <jann@thejh.net> - 2016-04-16 00:10 +0200
                Re: [PATCH 04/16] devpts: Teach /dev/ptmx to automount the appropriate devpts via path lookup ebiederm@xmission.com (Eric W. Biederman) - 2016-04-19 21:00 +0200
                [PATCH 09/16] devpts: Fail early (if appropriate) on overmount "Eric W. Biederman" <ebiederm@xmission.com> - 2016-04-15 17:50 +0200
                [PATCH 10/16] devpts: Move parse_mount_options into fill_super "Eric W. Biederman" <ebiederm@xmission.com> - 2016-04-15 17:50 +0200
                [PATCH 06/16] devpts: More obvious check for the system devpts in pty allocation "Eric W. Biederman" <ebiederm@xmission.com> - 2016-04-15 17:50 +0200
                [PATCH 01/16] devpts: Use the same default mode for both /dev/ptmx and dev/pts/ptmx "Eric W. Biederman" <ebiederm@xmission.com> - 2016-04-15 17:50 +0200
                [PATCH 12/16] devpts: Move the creation of /dev/pts/ptmx into fill_super "Eric W. Biederman" <ebiederm@xmission.com> - 2016-04-15 18:00 +0200
                [PATCH 11/16] devpts: Make devpts_kill_sb safe if fsi is NULL "Eric W. Biederman" <ebiederm@xmission.com> - 2016-04-15 18:00 +0200
                [PATCH 16/16] devpts: Kill the DEVPTS_MULTIPLE_INSTANCE config option "Eric W. Biederman" <ebiederm@xmission.com> - 2016-04-15 18:00 +0200
                [PATCH 15/16] devpts: Always return a distinct instance when mounting "Eric W. Biederman" <ebiederm@xmission.com> - 2016-04-15 18:00 +0200
                [PATCH 13/16] devpts: Simplify devpts_mount by using mount_nodev "Eric W. Biederman" <ebiederm@xmission.com> - 2016-04-15 18:00 +0200
                [PATCH 14/16] vfs: Implement mount_super_once "Eric W. Biederman" <ebiederm@xmission.com> - 2016-04-15 18:00 +0200
                Re: [PATCH 14/16] vfs: Implement mount_super_once Linus Torvalds <torvalds@linux-foundation.org> - 2016-04-16 01:10 +0200
                Re: [PATCH 14/16] vfs: Implement mount_super_once ebiederm@xmission.com (Eric W. Biederman) - 2016-04-19 20:40 +0200
                Re: [PATCH 14/16] vfs: Implement mount_super_once "H. Peter Anvin" <hpa@zytor.com> - 2016-04-19 21:00 +0200
                Re: [PATCH 14/16] vfs: Implement mount_super_once ebiederm@xmission.com (Eric W. Biederman) - 2016-04-19 21:20 +0200
                Re: [PATCH 14/16] vfs: Implement mount_super_once "H. Peter Anvin" <hpa@zytor.com> - 2016-04-19 21:30 +0200
                Re: [PATCH 14/16] vfs: Implement mount_super_once ebiederm@xmission.com (Eric W. Biederman) - 2016-04-20 05:40 +0200
                Re: [PATCH 14/16] vfs: Implement mount_super_once "Austin S. Hemmelgarn" <ahferroin7@gmail.com> - 2016-04-20 14:00 +0200
                Re: [PATCH 14/16] vfs: Implement mount_super_once "H. Peter Anvin" <hpa@zytor.com> - 2016-04-20 18:20 +0200
                Re: [PATCH 14/16] vfs: Implement mount_super_once "H. Peter Anvin" <hpa@zytor.com> - 2016-04-19 21:30 +0200
                Re: [PATCH 14/16] vfs: Implement mount_super_once "H. Peter Anvin" <hpa@zytor.com> - 2016-04-19 21:00 +0200
                Re: [PATCH 14/16] vfs: Implement mount_super_once Linus Torvalds <torvalds@linux-foundation.org> - 2016-04-20 01:30 +0200
                Re: [PATCH 14/16] vfs: Implement mount_super_once Linus Torvalds <torvalds@linux-foundation.org> - 2016-04-20 03:30 +0200
                Re: [PATCH 14/16] vfs: Implement mount_super_once "H. Peter Anvin" <hpa@zytor.com> - 2016-04-20 03:50 +0200
                Re: [PATCH 01/16] devpts: Attempting to get it right Andy Lutomirski <luto@amacapital.net> - 2016-04-15 18:50 +0200
                Re: [PATCH 01/16] devpts: Attempting to get it right ebiederm@xmission.com (Eric W. Biederman) - 2016-04-15 23:00 +0200
                Re: [PATCH 01/16] devpts: Attempting to get it right "H. Peter Anvin" <hpa@zytor.com> - 2016-04-15 23:40 +0200
                Re: [PATCH 01/16] devpts: Attempting to get it right ebiederm@xmission.com (Eric W. Biederman) - 2016-04-19 21:20 +0200
                Re: [PATCH 01/16] devpts: Attempting to get it right Linus Torvalds <torvalds@linux-foundation.org> - 2016-04-16 20:40 +0200
                Does anyone care about a race free ptsname? ebiederm@xmission.com (Eric W. Biederman) - 2016-04-19 21:00 +0200
                Re: Does anyone care about a race free ptsname? "H. Peter Anvin" <hpa@zytor.com> - 2016-04-19 21:30 +0200
                Re: Does anyone care about a race free ptsname? ebiederm@xmission.com (Eric W. Biederman) - 2016-04-19 22:50 +0200
                Re: Does anyone care about a race free ptsname? "H. Peter Anvin" <hpa@zytor.com> - 2016-04-19 23:10 +0200
                Re: Does anyone care about a race free ptsname? "Serge E. Hallyn" <serge@hallyn.com> - 2016-04-19 22:50 +0200
                Re: Does anyone care about a race free ptsname? Linus Torvalds <torvalds@linux-foundation.org> - 2016-04-20 01:30 +0200
                Re: Does anyone care about a race free ptsname? "H. Peter Anvin" <hpa@zytor.com> - 2016-04-20 01:50 +0200
                Re: Does anyone care about a race free ptsname? Linus Torvalds <torvalds@linux-foundation.org> - 2016-04-20 02:20 +0200
                Re: Does anyone care about a race free ptsname? "Serge E. Hallyn" <serge@hallyn.com> - 2016-04-20 03:50 +0200
                Re: [PATCH 01/16] devpts: Attempting to get it right ebiederm@xmission.com (Eric W. Biederman) - 2016-04-20 00:20 +0200
                Re: [PATCH 01/16] devpts: Attempting to get it right Linus Torvalds <torvalds@linux-foundation.org> - 2016-04-20 01:40 +0200
                Re: [PATCH 01/16] devpts: Attempting to get it right Peter Hurley <peter@hurleysoftware.com> - 2016-04-20 02:30 +0200
                Re: [PATCH 01/16] devpts: Attempting to get it right Peter Hurley <peter@hurleysoftware.com> - 2016-04-20 02:50 +0200
                [PATCH] devpts: Make each mount of devpts an independent filesystem. ebiederm@xmission.com (Eric W. Biederman) - 2016-04-20 05:20 +0200
                Re: [PATCH] devpts: Make each mount of devpts an independent  filesystem. Al Viro <viro@ZenIV.linux.org.uk> - 2016-04-20 05:30 +0200
                Re: [PATCH] devpts: Make each mount of devpts an independent filesystem. ebiederm@xmission.com (Eric W. Biederman) - 2016-04-20 06:00 +0200
                Re: [PATCH] devpts: Make each mount of devpts an independent  filesystem. Al Viro <viro@ZenIV.linux.org.uk> - 2016-04-20 06:20 +0200
                Re: [PATCH] devpts: Make each mount of devpts an independent filesystem. ebiederm@xmission.com (Eric W. Biederman) - 2016-04-20 06:40 +0200
                Re: [PATCH] devpts: Make each mount of devpts an independent filesystem. Konstantin Khlebnikov <koct9i@gmail.com> - 2016-04-20 06:40 +0200
                Re: [PATCH] devpts: Make each mount of devpts an independent filesystem. Linus Torvalds <torvalds@linux-foundation.org> - 2016-04-20 07:00 +0200
                Re: [PATCH] devpts: Make each mount of devpts an independent filesystem. ebiederm@xmission.com (Eric W. Biederman) - 2016-04-20 17:10 +0200
                Re: [PATCH] devpts: Make each mount of devpts an independent filesystem. Konstantin Khlebnikov <koct9i@gmail.com> - 2016-04-20 17:40 +0200
                Re: [PATCH] devpts: Make each mount of devpts an independent filesystem. ebiederm@xmission.com (Eric W. Biederman) - 2016-04-20 18:10 +0200
                [PATCH v2] devpts: Make each mount of devpts an independent filesystem. ebiederm@xmission.com (Eric W. Biederman) - 2016-04-20 19:20 +0200
                Re: [PATCH 01/13] devpts: Teach /dev/ptmx to find the associated devpts via path lookup ebiederm@xmission.com (Eric W. Biederman) - 2016-04-12 02:10 +0200
                Re: [PATCH 01/13] devpts: Teach /dev/ptmx to find the associated  devpts via path lookup Linus Torvalds <torvalds@linux-foundation.org> - 2016-04-12 02:10 +0200
                Re: [PATCH 01/13] devpts: Teach /dev/ptmx to find the associated devpts via path lookup ebiederm@xmission.com (Eric W. Biederman) - 2016-04-12 02:40 +0200
                Re: [PATCH 01/13] devpts: Teach /dev/ptmx to find the associated  devpts via path lookup Linus Torvalds <torvalds@linux-foundation.org> - 2016-04-12 03:00 +0200
                Re: [PATCH 01/13] devpts: Teach /dev/ptmx to find the associated devpts via path lookup ebiederm@xmission.com (Eric W. Biederman) - 2016-04-11 22:20 +0200

csiph-web