lkml.org 
[lkml]   [2014]   [Oct]   [21]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
Date
SubjectRe: [fuse-devel] [PATCH v4 4/5] fuse: Support privileged xattrs only with a mount option
On Tue, Oct 21, 2014 at 2:34 PM, Michael j Theall <mtheall@us.ibm.com> wrote:
> Andy Lutomirski <luto@amacapital.net> wrote on 10/21/2014 04:27:13 PM:
>> But how does this help with FUSE at all? Does FUSE end up calling
>> xattr_permission?
>>
>> --Andy
>>
>
> The xattr system calls go through xattr_permission before it ever gets to
> the FUSE ops.

But a malicious FUSE filesystem can just put those xattrs there by
fiat, the same way that my old FUSE-based sploit put a setuid root
copy of bash in the filesystem. No setxattr calls are needed.

--Andy


\
 
 \ /
  Last update: 2014-10-22 00:21    [W:0.066 / U:9.420 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site