)]}' { "commit": "b0cce01be5f58ed399fdfc8e1b0fbcd827a35aef", "tree": "cf61f307b591ed355c8a8df39d43d9649fd0ee18", "parents": [ "7646c507f1ad8bd14a3196f84b0eabb229dafb75" ], "author": { "name": "Kees Cook", "email": "keescook@chromium.org", "time": "Fri Sep 04 15:44:57 2015 -0700" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Wed Apr 27 18:55:18 2016 +0800" }, "message": "fs: create and use seq_show_option for escaping\n\ncommit a068acf2ee77693e0bf39d6e07139ba704f461c3 upstream.\n\nMany file systems that implement the show_options hook fail to correctly\nescape their output which could lead to unescaped characters (e.g. new\nlines) leaking into /proc/mounts and /proc/[pid]/mountinfo files. This\ncould lead to confusion, spoofed entries (resulting in things like\nsystemd issuing false d-bus \"mount\" notifications), and who knows what\nelse. This looks like it would only be the root user stepping on\nthemselves, but it\u0027s possible weird things could happen in containers or\nin other situations with delegated mount privileges.\n\nHere\u0027s an example using overlay with setuid fusermount trusting the\ncontents of /proc/mounts (via the /etc/mtab symlink). Imagine the use\nof \"sudo\" is something more sneaky:\n\n $ BASE\u003d\"ovl\"\n $ MNT\u003d\"$BASE/mnt\"\n $ LOW\u003d\"$BASE/lower\"\n $ UP\u003d\"$BASE/upper\"\n $ WORK\u003d\"$BASE/work/ 0 0\n none /proc fuse.pwn user_id\u003d1000\"\n $ mkdir -p \"$LOW\" \"$UP\" \"$WORK\"\n $ sudo mount -t overlay -o \"lowerdir\u003d$LOW,upperdir\u003d$UP,workdir\u003d$WORK\" none /mnt\n $ cat /proc/mounts\n none /root/ovl/mnt overlay rw,relatime,lowerdir\u003dovl/lower,upperdir\u003dovl/upper,workdir\u003dovl/work/ 0 0\n none /proc fuse.pwn user_id\u003d1000 0 0\n $ fusermount -u /proc\n $ cat /proc/mounts\n cat: /proc/mounts: No such file or directory\n\nThis fixes the problem by adding new seq_show_option and\nseq_show_option_n helpers, and updating the vulnerable show_option\nhandlers to use them as needed. Some, like SELinux, need to be open\ncoded due to unusual existing escape mechanisms.\n\n[akpm@linux-foundation.org: add lost chunk, per Kees]\n[keescook@chromium.org: seq_show_option should be using const parameters]\nSigned-off-by: Kees Cook \u003ckeescook@chromium.org\u003e\nAcked-by: Serge Hallyn \u003cserge.hallyn@canonical.com\u003e\nAcked-by: Jan Kara \u003cjack@suse.com\u003e\nAcked-by: Paul Moore \u003cpaul@paul-moore.com\u003e\nCc: J. R. Okajima \u003chooanon05g@gmail.com\u003e\nSigned-off-by: Kees Cook \u003ckeescook@chromium.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n[lizf: Backported to 3.4:\n - adjust context\n - one more place in ceph needs to be changed\n - drop changes to overlayfs\n - drop showing vers in cifs]\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n", "tree_diff": [ { "type": "modify", "old_id": "f4fa5cf0cdf1d5808a4c8f3685562ab4dd774a84", "old_mode": 33188, "old_path": "fs/ceph/super.c", "new_id": "e5eacd9dd5328c1e8d0487a537793137d3e897f6", "new_mode": 33188, "new_path": "fs/ceph/super.c" }, { "type": "modify", "old_id": "c0f65e84873eec50260ccc1e4d0a2a557ca8da83", "old_mode": 33188, "old_path": "fs/cifs/cifsfs.c", "new_id": "5b730ba78ae37770daed42ff2e27d8dc6a192221", "new_mode": 33188, "new_path": "fs/cifs/cifsfs.c" }, { "type": "modify", "old_id": "2e26a542c8189470784ce28c64ab052fa9855ba1", "old_mode": 33188, "old_path": "fs/ext4/super.c", "new_id": "3de888c3894acf6b179696101873d49cbf92d52a", "new_mode": 33188, "new_path": "fs/ext4/super.c" }, { "type": "modify", "old_id": "6172fa77ad59acf938d7a82f12c6bd1b78735df0", "old_mode": 33188, "old_path": "fs/gfs2/super.c", "new_id": "4db9a9a31f29247f113ccf13a643fbac8d198e53", "new_mode": 33188, "new_path": "fs/gfs2/super.c" }, { "type": "modify", "old_id": "7b4c537d6e136b42fba064de39b0c57703b5fec3", "old_mode": 33188, "old_path": "fs/hfs/super.c", "new_id": "be0e218a333ecae9f07fbc3a4f7491e24e8ba907", "new_mode": 33188, "new_path": "fs/hfs/super.c" }, { "type": "modify", "old_id": "06fa5618600c86c18b033b27a89bea1a91fbeaaf", "old_mode": 33188, "old_path": "fs/hfsplus/options.c", "new_id": "38e41d07d67f38e6975626a60cf528f5a5558266", "new_mode": 33188, "new_path": "fs/hfsplus/options.c" }, { "type": "modify", "old_id": "07c516bfea7671853513d9a80f61f81d5f674f91", "old_mode": 33188, "old_path": "fs/hostfs/hostfs_kern.c", "new_id": "fe63b15f54d2d1a5e54ebb291c7ec4951d99dc1f", "new_mode": 33188, "new_path": "fs/hostfs/hostfs_kern.c" }, { "type": "modify", "old_id": "68f4541c2db98b26a3aba49234c721e56d56e3c3", "old_mode": 33188, "old_path": "fs/ocfs2/super.c", "new_id": "91a0020a0ad321ec5f995f5239728d91be37bcc5", "new_mode": 33188, "new_path": "fs/ocfs2/super.c" }, { "type": "modify", "old_id": "8169be93ac0fc1c595ac4c13cafe4aaa6632d14e", "old_mode": 33188, "old_path": "fs/reiserfs/super.c", "new_id": "e12357bb309080818f9f32a6086cdda5e3f00210", "new_mode": 33188, "new_path": "fs/reiserfs/super.c" }, { "type": "modify", "old_id": "dab9a5f6dfd68345646849f6ca391fa3849839bb", "old_mode": 33188, "old_path": "fs/xfs/xfs_super.c", "new_id": "d6c787dc261d7447f9b6616939eb78e9b5655900", "new_mode": 33188, "new_path": "fs/xfs/xfs_super.c" }, { "type": "modify", "old_id": "fc61854f62247b9cbaf7bf490d8580f99d54b34e", "old_mode": 33188, "old_path": "include/linux/seq_file.h", "new_id": "149b92f055620ee9918d249ceba308ebd546fadc", "new_mode": 33188, "new_path": "include/linux/seq_file.h" }, { "type": "modify", "old_id": "34eda955e88743d5d4aabe1691296828e4e61275", "old_mode": 33188, "old_path": "kernel/cgroup.c", "new_id": "7ff5702507a5b65db4698d9bca23ab4adb774952", "new_mode": 33188, "new_path": "kernel/cgroup.c" }, { "type": "modify", "old_id": "cbae6d392087cd05658c899ea52968ce7ab033c9", "old_mode": 33188, "old_path": "security/selinux/hooks.c", "new_id": "312d2fb598d7bb59ec3748b178e8ddd1e6a4edde", "new_mode": 33188, "new_path": "security/selinux/hooks.c" } ] }