linux-stable.git/fs/namei.c, branch linux-3.7.y

lookup_one_len: don't accept . and ..

2012-11-30T03:17:21+00:00

Signed-off-by: Al Viro

VFS: don't do protected {sym,hard}links by default

2012-10-26T17:05:07+00:00

In commit 800179c9b8a1 ("This adds symlink and hardlink restrictions to
the Linux VFS"), the new link protections were enabled by default, in
the hope that no actual application would care, despite it being
technically against legacy UNIX (and documented POSIX) behavior.

However, it does turn out to break some applications.  It's rare, and
it's unfortunate, but it's unacceptable to break existing systems, so
we'll have to default to legacy behavior.

In particular, it has broken the way AFD distributes files, see

  http://www.dwd.de/AFD/

along with some legacy scripts.

Distributions can end up setting this at initrd time or in system
scripts: if you have security problems due to link attacks during your
early boot sequence, you have bigger problems than some kernel sysctl
setting. Do:

	echo 1 > /proc/sys/fs/protected_symlinks
	echo 1 > /proc/sys/fs/protected_hardlinks

to re-enable the link protections.

Alternatively, we may at some point introduce a kernel config option
that sets these kinds of "more secure but not traditional" behavioural
options automatically.

Reported-by: Nick Bowler 
Reported-by: Holger Kiehl 
Cc: Kees Cook 
Cc: Ingo Molnar 
Cc: Andrew Morton 
Cc: Al Viro 
Cc: Alan Cox 
Cc: Theodore Ts'o 
Cc: stable@kernel.org # v3.6
Signed-off-by: Linus Torvalds

vfs: embed struct filename inside of names_cache allocation if possible

2012-10-13T00:15:10+00:00

In the common case where a name is much smaller than PATH_MAX, an extra
allocation for struct filename is unnecessary. Before allocating a
separate one, try to embed the struct filename inside the buffer first. If
it turns out that that's not long enough, then fall back to allocating a
separate struct filename and redoing the copy.

Signed-off-by: Jeff Layton 
Signed-off-by: Al Viro

audit: make audit_inode take struct filename

2012-10-13T00:15:09+00:00

Keep a pointer to the audit_names "slot" in struct filename.

Have all of the audit_inode callers pass a struct filename ponter to
audit_inode instead of a string pointer. If the aname field is already
populated, then we can skip walking the list altogether and just use it
directly.

Signed-off-by: Jeff Layton 
Signed-off-by: Al Viro

vfs: make path_openat take a struct filename pointer

2012-10-13T00:15:09+00:00

...and fix up the callers. For do_file_open_root, just declare a
struct filename on the stack and fill out the .name field. For
do_filp_open, make it also take a struct filename pointer, and fix up its
callers to call it appropriately.

For filp_open, add a variant that takes a struct filename pointer and turn
filp_open into a wrapper around it.

Signed-off-by: Jeff Layton 
Signed-off-by: Al Viro

vfs: turn do_path_lookup into wrapper around struct filename variant

2012-10-13T00:15:08+00:00

...and make the user_path callers use that variant instead.

Signed-off-by: Jeff Layton 
Signed-off-by: Al Viro

audit: allow audit code to satisfy getname requests from its names_list

2012-10-13T00:15:08+00:00

Currently, if we call getname() on a userland string more than once,
we'll get multiple copies of the string and multiple audit_names
records.

Add a function that will allow the audit_names code to satisfy getname
requests using info from the audit_names list, avoiding a new allocation
and audit_names records.

Signed-off-by: Jeff Layton 
Signed-off-by: Al Viro

vfs: define struct filename and have getname() return it

2012-10-13T00:14:55+00:00

getname() is intended to copy pathname strings from userspace into a
kernel buffer. The result is just a string in kernel space. It would
however be quite helpful to be able to attach some ancillary info to
the string.

For instance, we could attach some audit-related info to reduce the
amount of audit-related processing needed. When auditing is enabled,
we could also call getname() on the string more than once and not
need to recopy it from userspace.

This patchset converts the getname()/putname() interfaces to return
a struct instead of a string. For now, the struct just tracks the
string in kernel space and the original userland pointer for it.

Later, we'll add other information to the struct as it becomes
convenient.

Signed-off-by: Jeff Layton 
Signed-off-by: Al Viro

vfs: unexport getname and putname symbols

2012-10-12T04:32:09+00:00

I see no callers in module code.

Signed-off-by: Jeff Layton 
Signed-off-by: Al Viro

audit: overhaul __audit_inode_child to accomodate retrying

2012-10-12T04:32:03+00:00

In order to accomodate retrying path-based syscalls, we need to add a
new "type" argument to audit_inode_child. This will tell us whether
we're looking for a child entry that represents a create or a delete.

If we find a parent, don't automatically assume that we need to create a
new entry. Instead, use the information we have to try to find an
existing entry first. Update it if one is found and create a new one if
not.

Signed-off-by: Jeff Layton 
Signed-off-by: Al Viro