oss-sec mailing list archives
Re: Untrusted fs and invalid filenames
From: Stephan Mueller <stephan.mueller () atsec com>
Date: Mon, 14 Mar 2011 09:12:34 +0100
Am Samstag, 12. März 2011, um 18:03:45 schrieb Vasiliy Kulikov: Hi Vasiliy,
What I suggest is something like "-o untrusted" option to mount. This would mean that the system considers the input from such fs as a malicious input. Such mounted fs would try to consider the data on disk as untrusted and to be as robust as possible, e.g. check against "/"-filenames, against corrupted fs structures, etc. I'd be happy to hear opinions about the usefulness of this feature.
I completely second your concerns. However, how do you propose to implement that "untrusted" option? The core problem IMHO is that the physical layout and structure in a file system is assumed to be correct in general by the kernel. The physical file system implementations (including any depending code, like the LSMs for interpreting XATTRs) have some checks for an input validation. But I highly doubt that all checks necessary for an untrusted file system layout are implemented - to have all such checks would cause some speed penalties nobody wants to carry. For example, the more sophisticated physical file systems (ext3/4, btrfs or xfs come to mind) use pointers to the different blocks/extends. Is it really ensured that misalignment of these pointers cannot cause adverse consequences - at least crash the system? Therefore, if you consider a file system untrusted, a simple flag "untrusted" which disables some high-level logic (like symlinks across partitions or funky file names) may just be window-dressing until the entire parsing of the physical data structure layout is hardened. Ciao Stephan
Current thread:
- Untrusted fs and invalid filenames Vasiliy Kulikov (Mar 12)
- Re: Untrusted fs and invalid filenames Steve Grubb (Mar 13)
- Re: Untrusted fs and invalid filenames Eitan Adler (Mar 13)
- Re: Untrusted fs and invalid filenames Stephan Mueller (Mar 14)
- Re: Untrusted fs and invalid filenames Dan Rosenberg (Mar 14)
- Re: Untrusted fs and invalid filenames Stephan Mueller (Mar 14)
- Re: Untrusted fs and invalid filenames Steve Grubb (Mar 14)
- Re: Untrusted fs and invalid filenames Vasiliy Kulikov (Mar 14)
- Re: Untrusted fs and invalid filenames Ludwig Nussel (Mar 14)
- Re: Untrusted fs and invalid filenames Steve Grubb (Mar 14)
- Re: Untrusted fs and invalid filenames Dan Rosenberg (Mar 14)