linux/fs/cifs
Kees Cook a068acf2ee fs: create and use seq_show_option for escaping
Many file systems that implement the show_options hook fail to correctly
escape their output which could lead to unescaped characters (e.g.  new
lines) leaking into /proc/mounts and /proc/[pid]/mountinfo files.  This
could lead to confusion, spoofed entries (resulting in things like
systemd issuing false d-bus "mount" notifications), and who knows what
else.  This looks like it would only be the root user stepping on
themselves, but it's possible weird things could happen in containers or
in other situations with delegated mount privileges.

Here's an example using overlay with setuid fusermount trusting the
contents of /proc/mounts (via the /etc/mtab symlink).  Imagine the use
of "sudo" is something more sneaky:

  $ BASE="ovl"
  $ MNT="$BASE/mnt"
  $ LOW="$BASE/lower"
  $ UP="$BASE/upper"
  $ WORK="$BASE/work/ 0 0
  none /proc fuse.pwn user_id=1000"
  $ mkdir -p "$LOW" "$UP" "$WORK"
  $ sudo mount -t overlay -o "lowerdir=$LOW,upperdir=$UP,workdir=$WORK" none /mnt
  $ cat /proc/mounts
  none /root/ovl/mnt overlay rw,relatime,lowerdir=ovl/lower,upperdir=ovl/upper,workdir=ovl/work/ 0 0
  none /proc fuse.pwn user_id=1000 0 0
  $ fusermount -u /proc
  $ cat /proc/mounts
  cat: /proc/mounts: No such file or directory

This fixes the problem by adding new seq_show_option and
seq_show_option_n helpers, and updating the vulnerable show_option
handlers to use them as needed.  Some, like SELinux, need to be open
coded due to unusual existing escape mechanisms.

[akpm@linux-foundation.org: add lost chunk, per Kees]
[keescook@chromium.org: seq_show_option should be using const parameters]
Signed-off-by: Kees Cook <keescook@chromium.org>
Acked-by: Serge Hallyn <serge.hallyn@canonical.com>
Acked-by: Jan Kara <jack@suse.com>
Acked-by: Paul Moore <paul@paul-moore.com>
Cc: J. R. Okajima <hooanon05g@gmail.com>
Signed-off-by: Kees Cook <keescook@chromium.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2015-09-04 16:54:41 -07:00
..
asn1.c [CIFS] cifs: Rename cERROR and cFYI to cifs_dbg 2013-05-04 22:17:23 -05:00
cache.c [CIFS] cifs: Rename cERROR and cFYI to cifs_dbg 2013-05-04 22:17:23 -05:00
cifs_debug.c cifs: fix MUST SecurityFlags filtering 2015-01-26 19:38:26 -06:00
cifs_debug.h cifs: convert printk(LEVEL...) to pr_<level> 2014-12-07 22:48:07 -06:00
cifs_dfs_ref.c Fix that several functions handle incorrect value of mapchars 2015-05-10 19:56:35 -05:00
cifs_fs_sb.h Allow conversion of characters in Mac remap range. Part 1 2014-10-16 15:20:20 -05:00
cifs_spnego.c KEYS: Remove key_type::match in favour of overriding default by match_preparse 2014-09-16 17:36:06 +01:00
cifs_spnego.h
cifs_unicode.c Fix to convert SURROGATE PAIR 2015-05-20 13:12:51 -05:00
cifs_unicode.h Remap reserved posix characters by default (part 3/3) 2014-10-16 15:20:20 -05:00
cifs_uniupr.h
cifsacl.c fs/cifs: remove obsolete __constant 2014-12-10 17:41:02 -08:00
cifsacl.h cifs: fix SID binary to string conversion 2012-12-11 11:48:49 -06:00
cifsencrypt.c CIFS: session servername can't be null 2015-04-01 00:01:47 -05:00
cifsfs.c fs: create and use seq_show_option for escaping 2015-09-04 16:54:41 -07:00
cifsfs.h don't pass nameidata to ->follow_link() 2015-05-10 22:20:15 -04:00
cifsglob.h Add ioctl to set integrity 2015-06-28 21:15:45 -05:00
cifspdu.h Add reflink copy over SMB3.11 with new FSCTL_DUPLICATE_EXTENTS 2015-06-28 21:15:38 -05:00
cifsproto.h Fix that several functions handle incorrect value of mapchars 2015-05-10 19:56:35 -05:00
cifssmb.c client MUST ignore EncryptionKeyLength if CAP_EXTENDED_SECURITY is set 2015-06-27 20:26:00 -07:00
connect.c cifs: Unset CIFS_MOUNT_POSIX_PATHS flag when following dfs mounts 2015-06-29 14:50:22 -05:00
dir.c Fix that several functions handle incorrect value of mapchars 2015-05-10 19:56:35 -05:00
dns_resolve.c cifs: fix composing of mount options for DFS referrals 2013-05-24 13:08:31 -05:00
dns_resolve.h
export.c [CIFS] cifs: Rename cERROR and cFYI to cifs_dbg 2013-05-04 22:17:23 -05:00
file.c cifs: potential missing check for posix_lock_file_wait 2015-05-20 13:08:33 -05:00
fscache.c NFS client updates for Linux 3.13 2013-11-08 05:57:46 +09:00
fscache.h CIFS: FS-Cache: Uncache unread pages in cifs_readpages() before freeing them 2013-09-18 10:17:03 -05:00
inode.c Fix to check Unique id and FileType when client refer file directly. 2015-05-20 13:05:25 -05:00
ioctl.c Add ioctl to set integrity 2015-06-28 21:15:45 -05:00
Kconfig Allow parsing vers=3.11 on cifs mount 2015-06-27 20:23:32 -07:00
link.c Merge branch 'for-linus-1' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2015-06-22 12:51:21 -07:00
Makefile cifs: add new case-insensitive conversion routines that are based on wchar_t's 2013-09-08 14:38:05 -05:00
misc.c VFS: normal filesystems (and lustre): d_inode() annotations 2015-04-15 15:06:57 -04:00
netmisc.c Fix signed/unsigned pointer warning 2014-12-14 14:55:57 -06:00
nterr.c
nterr.h
ntlmssp.h
readdir.c cifs: Don't replace dentries for dfs mounts 2015-05-10 19:56:05 -05:00
rfc1002pdu.h
sess.c Merge branch 'akpm' (patchbomb from Andrew) 2014-12-10 18:34:42 -08:00
smb1ops.c Fix that several functions handle incorrect value of mapchars 2015-05-10 19:56:35 -05:00
smb2file.c VFS: normal filesystems (and lustre): d_inode() annotations 2015-04-15 15:06:57 -04:00
smb2glob.h CIFS: Fix too big maxBuf size for SMB3 mounts 2014-02-14 16:50:47 -06:00
smb2inode.c CIFS: Fix wrong filename length for SMB2 2014-08-25 16:45:17 -05:00
smb2maperror.c Fix problem recognizing symlinks 2014-10-02 14:10:04 -05:00
smb2misc.c VFS: normal filesystems (and lustre): d_inode() annotations 2015-04-15 15:06:57 -04:00
smb2ops.c Add ioctl to set integrity 2015-06-28 21:15:45 -05:00
smb2pdu.c Update negotiate protocol for SMB3.11 dialect 2015-06-28 21:15:48 -05:00
smb2pdu.h Update negotiate protocol for SMB3.11 dialect 2015-06-28 21:15:48 -05:00
smb2proto.h mfsymlinks support for SMB2.1/SMB3. Part 2 query symlink 2014-10-16 15:20:20 -05:00
smb2status.h
smb2transport.c Convert MessageID in smb2_hdr to LE 2014-12-14 14:55:45 -06:00
smbencrypt.c cifs: use memzero_explicit to clear stack buffer 2015-01-19 15:32:13 -06:00
smberr.h
smbfsctl.h Add Get/Set Integrity Information structure definitions 2015-06-28 21:15:41 -05:00
transport.c cifs: convert printk(LEVEL...) to pr_<level> 2014-12-07 22:48:07 -06:00
winucase.c [CIFS] quiet sparse compile warning 2013-09-08 14:54:24 -05:00
xattr.c VFS: normal filesystems (and lustre): d_inode() annotations 2015-04-15 15:06:57 -04:00