Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1501045

Re: [RFC] [PATCH] Add a "nolinks" mount option.

Show all headers | View raw

On Fri, Oct 14, 2016 at 03:55:15PM +0100, Al Viro wrote:
> > Setting the "nolinks" mount option helps prevent privileged writers
> > from modifying files unintentionally in case there is an unexpected
> > link along the accessed path. The "nolinks" option is thus useful as a
> > defensive measure against persistent exploits (i.e. a system getting
> > re-exploited after a reboot) for systems that employ a read-only or
> > dm-verity-protected rootfs. These systems prevent non-legit binaries
> > from running after reboot. However, legit code typically still reads
> > from and writes to a writable file system previously under full
> > control of the attacker, who can place symlinks to trick file writes
> > after reboot to target a file of their choice. "nolinks" fundamentally
> > prevents this.
> 
> Which parts of the tree would be on that "protected" rootfs and which would
> you mount with that option?  Description above is rather vague and I'm
> not convinced that it actually buys you anything.  Details, please...

PS: what the hell do restrictions on _following_ symlinks have to _creating_
hardlinks?  I'm trying to imagine a threat model where both would apply or
anything else beyond the word "link" they would have in common...

The one you've described above might have something to do with the first
one (modulo missing description of the setup you have in mind), but it
clearly has nothing to do with the second - attackers could've created
whatever they wanted while the fs had been under their control, after all.
Doesn't make sense...

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[RFC] [PATCH] Add a "nolinks" mount option. Mattias Nissler <mnissler@chromium.org> - 2016-10-14 16:30 +0200
  Re: [RFC] [PATCH] Add a "nolinks" mount option. Al Viro <viro@ZenIV.linux.org.uk> - 2016-10-14 17:00 +0200
    Re: [RFC] [PATCH] Add a "nolinks" mount option. Al Viro <viro@ZenIV.linux.org.uk> - 2016-10-14 17:10 +0200
      Re: [RFC] [PATCH] Add a "nolinks" mount option. Mattias Nissler <mnissler@chromium.org> - 2016-10-14 18:00 +0200
        Re: [RFC] [PATCH] Add a "nolinks" mount option. Mattias Nissler <mnissler@chromium.org> - 2016-10-14 18:30 +0200
          Re: [RFC] [PATCH] Add a "nolinks" mount option. Mattias Nissler <mnissler@chromium.org> - 2016-10-17 15:10 +0200
            Re: [RFC] [PATCH] Add a "nolinks" mount option. "Austin S. Hemmelgarn" <ahferroin7@gmail.com> - 2016-10-17 16:20 +0200
            Re: [RFC] [PATCH] Add a "nolinks" mount option. Colin Walters <walters@verbum.org> - 2016-10-18 17:20 +0200
              Re: [RFC] [PATCH] Add a "nolinks" mount option. Mattias Nissler <mnissler@chromium.org> - 2016-10-19 16:20 +0200
                Re: [RFC] [PATCH] Add a "nolinks" mount option. Colin Walters <walters@verbum.org> - 2016-10-19 16:40 +0200

csiph-web