• Eric W. Biederman's avatar
    vfs: Test for and handle paths that are unreachable from their mnt_root · 397d425d
    Eric W. Biederman authored
    In rare cases a directory can be renamed out from under a bind mount.
    In those cases without special handling it becomes possible to walk up
    the directory tree to the root dentry of the filesystem and down
    from the root dentry to every other file or directory on the filesystem.
    
    Like division by zero .. from an unconnected path can not be given
    a useful semantic as there is no predicting at which path component
    the code will realize it is unconnected.  We certainly can not match
    the current behavior as the current behavior is a security hole.
    
    Therefore when encounting .. when following an unconnected path
    return -ENOENT.
    
    - Add a function path_connected to verify path->dentry is reachable
      from path->mnt.mnt_root.  AKA to validate that rename did not do
      something nasty to the bind mount.
    
      To avoid races path_connected must be called after following a path
      component to it's next path component.
    Signed-off-by: default avatar"Eric W. Biederman" <ebiederm@xmission.com>
    Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
    397d425d
namei.c 115 KB