WSL2-Linux-Kernel/fs/gfs2
Kees Cook a068acf2ee fs: create and use seq_show_option for escaping
Many file systems that implement the show_options hook fail to correctly
escape their output which could lead to unescaped characters (e.g.  new
lines) leaking into /proc/mounts and /proc/[pid]/mountinfo files.  This
could lead to confusion, spoofed entries (resulting in things like
systemd issuing false d-bus "mount" notifications), and who knows what
else.  This looks like it would only be the root user stepping on
themselves, but it's possible weird things could happen in containers or
in other situations with delegated mount privileges.

Here's an example using overlay with setuid fusermount trusting the
contents of /proc/mounts (via the /etc/mtab symlink).  Imagine the use
of "sudo" is something more sneaky:

  $ BASE="ovl"
  $ MNT="$BASE/mnt"
  $ LOW="$BASE/lower"
  $ UP="$BASE/upper"
  $ WORK="$BASE/work/ 0 0
  none /proc fuse.pwn user_id=1000"
  $ mkdir -p "$LOW" "$UP" "$WORK"
  $ sudo mount -t overlay -o "lowerdir=$LOW,upperdir=$UP,workdir=$WORK" none /mnt
  $ cat /proc/mounts
  none /root/ovl/mnt overlay rw,relatime,lowerdir=ovl/lower,upperdir=ovl/upper,workdir=ovl/work/ 0 0
  none /proc fuse.pwn user_id=1000 0 0
  $ fusermount -u /proc
  $ cat /proc/mounts
  cat: /proc/mounts: No such file or directory

This fixes the problem by adding new seq_show_option and
seq_show_option_n helpers, and updating the vulnerable show_option
handlers to use them as needed.  Some, like SELinux, need to be open
coded due to unusual existing escape mechanisms.

[akpm@linux-foundation.org: add lost chunk, per Kees]
[keescook@chromium.org: seq_show_option should be using const parameters]
Signed-off-by: Kees Cook <keescook@chromium.org>
Acked-by: Serge Hallyn <serge.hallyn@canonical.com>
Acked-by: Jan Kara <jack@suse.com>
Acked-by: Paul Moore <paul@paul-moore.com>
Cc: J. R. Okajima <hooanon05g@gmail.com>
Signed-off-by: Kees Cook <keescook@chromium.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2015-09-04 16:54:41 -07:00
..
Kconfig Finally eradicate CONFIG_HOTPLUG 2013-06-03 14:20:18 -07:00
Makefile GFS2: Rename ops_inode.c to inode.c 2011-05-10 13:12:49 +01:00
acl.c GFS2: gfs2_set_acl(): Cache "no acl" as well 2015-03-18 12:41:57 -05:00
acl.h GFS2: Increase the max number of ACLs 2014-03-19 15:16:24 +00:00
aops.c GFS2: merge window 2015-06-27 09:47:46 -07:00
bmap.c gfs2: perform quota checks against allocation parameters 2015-03-18 12:46:54 -05:00
bmap.h GFS2: Clean up journal extent mapping 2014-03-03 13:50:12 +00:00
dentry.c VFS: normal filesystems (and lustre): d_inode() annotations 2015-04-15 15:06:57 -04:00
dir.c VFS: (Scripted) Convert S_ISLNK/DIR/REG(dentry->d_inode) to d_is_*(dentry) 2015-02-22 11:38:41 -05:00
dir.h GFS2: Make rename not save dirent location 2014-10-01 14:06:15 +01:00
export.c VFS: normal filesystems (and lustre): d_inode() annotations 2015-04-15 15:06:57 -04:00
file.c GFS2: merge window 2015-06-27 09:47:46 -07:00
gfs2.h [GFS2] Remove remote lock dropping code 2008-06-27 09:39:44 +01:00
glock.c GFS2: Don't add all glocks to the lru 2015-06-18 12:17:59 -05:00
glock.h GFS2: Don't use ENOBUFS when ENOMEM is the correct error code 2014-01-16 10:31:13 +00:00
glops.c GFS2: Don't brelse rgrp buffer_heads every allocation 2015-06-19 07:40:22 -05:00
glops.h GFS2: update freeze code to use freeze/thaw_super on all nodes 2014-11-17 10:36:39 +00:00
incore.h GFS2: Don't add all glocks to the lru 2015-06-18 12:17:59 -05:00
inode.c GFS2: merge window 2015-06-27 09:47:46 -07:00
inode.h GFS2: Add atomic_open support 2013-06-14 11:17:15 +01:00
lock_dlm.c Merge branch 'sched/urgent' into sched/core, to merge fixes before applying new changes 2014-07-28 10:03:00 +02:00
log.c GFS2: update freeze code to use freeze/thaw_super on all nodes 2014-11-17 10:36:39 +00:00
log.h GFS2: remove transaction glock 2014-05-14 10:04:34 +01:00
lops.c block: remove bio_get_nr_vecs() 2015-08-13 12:32:04 -06:00
lops.h GFS2: Move log buffer lists into transaction 2014-02-24 16:54:54 +00:00
main.c GFS2: update freeze code to use freeze/thaw_super on all nodes 2014-11-17 10:36:39 +00:00
meta_io.c mm: non-atomically mark page accessed during page cache allocation where possible 2014-06-04 16:54:10 -07:00
meta_io.h GFS2: Fix address space from page function 2014-03-31 17:48:27 +01:00
ops_fstype.c block: add a bi_error field to struct bio 2015-07-29 08:55:15 -06:00
quota.c GFS2: merge window 2015-06-27 09:47:46 -07:00
quota.h gfs2: perform quota checks against allocation parameters 2015-03-18 12:46:54 -05:00
recovery.c GFS2: fix sprintf format specifier 2015-01-13 10:48:57 +00:00
recovery.h GFS2: Move recovery variables to journal structure in memory 2014-03-07 09:14:48 +00:00
rgrp.c GFS2: Don't brelse rgrp buffer_heads every allocation 2015-06-19 07:40:22 -05:00
rgrp.h GFS2: Don't brelse rgrp buffer_heads every allocation 2015-06-19 07:40:22 -05:00
super.c fs: create and use seq_show_option for escaping 2015-09-04 16:54:41 -07:00
super.h GFS2: update freeze code to use freeze/thaw_super on all nodes 2014-11-17 10:36:39 +00:00
sys.c gfs2: convert simple_str to kstr 2015-05-05 13:23:22 -05:00
sys.h GFS2: dlm based recovery coordination 2012-01-11 09:23:05 +00:00
trace_gfs2.h GFS2: Add origin indicator to glock demote tracing 2013-04-10 10:32:05 +01:00
trans.c GFS2: update freeze code to use freeze/thaw_super on all nodes 2014-11-17 10:36:39 +00:00
trans.h GFS2: Split gfs2_trans_add_bh() into two 2013-01-29 10:28:04 +00:00
util.c GFS2: Convert gfs2_lm_withdraw to use fs_err 2014-03-07 09:39:18 +00:00
util.h GFS2: Convert gfs2_lm_withdraw to use fs_err 2014-03-07 09:39:18 +00:00
xattr.c Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2015-04-26 17:22:07 -07:00
xattr.h sanitize xattr handler prototypes 2009-12-16 12:16:49 -05:00