| Commit message (Collapse) | Author | Age |
|---|
| | |
|
| | |
|
| | |
|
| | |
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Before:
$ _FUSE_COMMFD=1 priv_strace -s8000 -e trace=mount util/fusermount3 /proc/self/fd
mount("/dev/fuse", ".", "fuse", MS_NOSUID|MS_NODEV, "fd=3,rootmode=40000,user_id=379777,group_id=5001") = 0
sending file descriptor: Socket operation on non-socket
+++ exited with 1 +++
After:
$ _FUSE_COMMFD=1 priv_strace -s8000 -e trace=mount util/fusermount3 /proc/self/fd
util/fusermount3: mounting over filesystem type 0x009fa0 is forbidden
+++ exited with 1 +++
This patch could potentially have security
impact on some systems that are configured with allow_other;
see https://launchpad.net/bugs/1530566 for an example of how a similar
issue in the ecryptfs mount helper was exploitable. However, the FUSE
mount helper performs slightly different security checks, so that exact
attack doesn't work with fusermount; I don't know of any specific attack
you could perform using this, apart from faking the SELinux context of your
process when someone's looking at a process listing. Potential targets for
overwrite are (looking on a system with a 4.9 kernel):
writable only for the current process:
/proc/self/{fd,map_files}
(Yes, "ls -l" claims that you don't have write access, but that's not true;
"find -writable" will show you what access you really have.)
writable also for other owned processes:
/proc/$pid/{sched,autogroup,comm,mem,clear_refs,attr/*,oom_adj,
oom_score_adj,loginuid,coredump_filter,uid_map,gid_map,projid_map,
setgroups,timerslack_ns}
|
| |
|
|
|
|
|
|
|
|
|
|
| |
Blacklists are notoriously fragile; especially if the kernel wishes to add
some security-critical mount option at a later date, all existing systems
with older versions of fusermount installed will suddenly have a security
problem.
Additionally, if the kernel's option parsing became a tiny bit laxer, the
blacklist could probably be bypassed.
Whitelist known-harmless flags instead, even if it's slightly more
inconvenient.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
If an attacker wishes to use the default configuration instead of the
system's actual configuration, they can attempt to trigger a failure in
read_conf(). This only permits increasing mount_max if it is lower than the
default, so it's not particularly interesting. Still, this should probably
be prevented robustly; bail out if funny stuff happens when we're trying to
read the config.
Note that the classic attack trick of opening so many files that the
system-wide limit is reached won't work here - because fusermount only
drops the fsuid, not the euid, the process is running with euid=0 and
CAP_SYS_ADMIN, so it bypasses the number-of-globally-open-files check in
get_empty_filp() (unless you're inside a user namespace).
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
| |
The old code permits the following behavior:
$ _FUSE_COMMFD=10000 priv_strace -etrace=mount -s200 fusermount -o 'foobar=\,allow_other' mount
mount("/dev/fuse", ".", "fuse", MS_NOSUID|MS_NODEV, "foobar=\\,allow_other,fd=3,rootmode=40000,user_id=1000,group_id=1000") = -1 EINVAL (Invalid argument)
However, backslashes do not have any special meaning for the kernel here.
As it happens, you can't abuse this because there is no FUSE mount option
that takes a string value that can contain backslashes; but this is very
brittle. Don't interpret "escape characters" in places where they don't
work.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Currently, in the kernel, copy_mount_options() copies in one page of
userspace memory (or less if some of that memory area is not mapped).
do_mount() then writes a null byte to the last byte of the copied page.
This means that mount option strings longer than PAGE_SIZE-1 bytes get
truncated silently.
Therefore, this can happen:
user@d9-ut:~$ _FUSE_COMMFD=10000 fusermount -o "$(perl -e 'print ","x4000')" mount
sending file descriptor: Bad file descriptor
user@d9-ut:~$ grep /mount /proc/mounts
/dev/fuse /home/user/mount fuse rw,nosuid,nodev,relatime,user_id=1000,group_id=1000 0 0
user@d9-ut:~$ fusermount -u mount
user@d9-ut:~$ _FUSE_COMMFD=10000 fusermount -o "$(perl -e 'print ","x4050')" mount
sending file descriptor: Bad file descriptor
user@d9-ut:~$ grep /mount /proc/mounts
/dev/fuse /home/user/mount fuse rw,nosuid,nodev,relatime,user_id=1000,group_id=100 0 0
user@d9-ut:~$ fusermount -u mount
user@d9-ut:~$ _FUSE_COMMFD=10000 fusermount -o "$(perl -e 'print ","x4051')" mount
sending file descriptor: Bad file descriptor
user@d9-ut:~$ grep /mount /proc/mounts
/dev/fuse /home/user/mount fuse rw,nosuid,nodev,relatime,user_id=1000,group_id=10 0 0
user@d9-ut:~$ fusermount -u mount
user@d9-ut:~$ _FUSE_COMMFD=10000 fusermount -o "$(perl -e 'print ","x4052')" mount
sending file descriptor: Bad file descriptor
user@d9-ut:~$ grep /mount /proc/mounts
/dev/fuse /home/user/mount fuse rw,nosuid,nodev,relatime,user_id=1000,group_id=1 0 0
user@d9-ut:~$ fusermount -u mount
I'm not aware of any context in which this is actually exploitable - you'd
still need the UIDs to fit, and you can't do it if the three GIDs of the
process don't match (in the case of a typical setgid binary), but it does
look like something that should be fixed.
I also plan to try to get this fixed on the kernel side.
|
| | |
|
| |
|
|
| |
Fixes: #222.
|
| |
|
|
|
|
|
|
|
|
|
|
|
| |
Silence below warnings which appear if IGNORE_MTAB is defined.
[59/64] Compiling C object 'util/fusermount3@exe/fusermount.c.o'.
../util/fusermount.c:493:12: warning: function declaration isn't a prototype [-Wstrict-prototypes]
static int count_fuse_fs()
^~~~~~~~~~~~~
../util/fusermount.c: In function 'unmount_fuse':
../util/fusermount.c:508:46: warning: unused parameter 'quiet' [-Wunused-parameter]
static int unmount_fuse(const char *mnt, int quiet, int lazy)
^~~~~
|
| |
|
|
| |
Add a configuration file with all options disabled that includes
all valid options and their description.
|
| |
|
| |
Accept (and ignore) nofail mount option
|
| |
|
|
| |
on nixos we install fuse in its own hierarchy independent from systemd.
|
| |
|
|
| |
It's just too much pain to keep it working.
|
| | |
|
| | |
|
| |
|
|
| |
There is a proper meson-mode now.
|
| |
|
|
| |
Fixes: #178.
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| |
|
|
|
| |
This brings the default behavior in-line with that of the
regular `mount` command.
|
| |
|
|
|
| |
...options. Uids/gids larger than 2147483647 would result in EINVAL when
mounting the filesystem. This also needs a fix in the kernel.
|
| |\ |
|
| | |
| |
| |
| | |
This allows compiling fuse with musl.
|
| | | |
|
| | |
| |
| |
| |
| |
| | |
Distribute ulockmgr separately. It is not needed for the building of
libfuse, only fusexmp_fh. Check ulockmgr library in ./configure and if not
disable remote-lock suport in fusexmp_fh.
|
| |/
|
|
| |
add AC_SYS_LARGEFILE to your configure.ac instead.
|
| |
|
|
|
|
|
|
|
|
|
|
| |
mkdir_p is deprecated since automake 1.12.1 (see automake commit
7a1eb9ff9027929687f12905e131f6fda3fa6d0c).
MKDIR_P should be used instead of mkdir_p.
This is available since autoconf 2.59d (2006-06-05), by calling
AC_PROG_MKDIR_P.
The mkdir_p workaround was not working anyway for out-of-tree builds,
since the ../mkinstalldirs path would be incorrect.
|
| |
|
|
|
|
|
| |
When building out-of-tree, install fails since it tries to copy
mount.fuse binary from source directory.
Patch initially from Damien Thébault (SoftAtHome)
|
| |
|
|
|
|
|
|
| |
fusermount.c: In function 'clone_newns':
fusermount.c:315:2: warning: implicit declaration of function 'clone' [-Wimplicit-function-declaration]
fusermount.c:315:44: error: 'CLONE_NEWNS' undeclared (first use in this function)
fusermount.c:315:44: note: each undeclared identifier is reported only once for each function it appears in
fusermount.c:317:1: warning: control reaches end of non-void function [-Wreturn-type]
|
| |
|
|
|
|
|
|
| |
daemon() is a BSD-ism. Although it is available on many platforms
it is not a standard function. Some platforms (e.g. MacOSX) deprecated
it.
It is safer just to use fork() function that is a part of POSIX.
|
| |
|
|
|
|
|
|
|
|
|
| |
...with the help of vim :set spell
modified: FAQ
modified: include/fuse.h
modified: include/fuse_common.h
modified: include/fuse_opt.h
modified: lib/fuse_kern_chan.c
modified: util/fusermount.c
|
| |
|
|
|
|
|
|
|
| |
fprintf(stderr, whatever); -> fprintf(stderr, "%s", whatever);
checking return values on chdir and lockf where we weren't already
modified: example/cusexmp.c
modified: example/fioclient.c
modified: util/fusermount.c
|
| |
|
|
|
|
| |
When this option is specified fusermount will become a daemon and wait for the
parent to exit or die, which causes control fd to get closed. It will then try
to unmount the original mountpoint.
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| |
|
|
| |
Reported by Marc Deslauriers
|
| |
|
|
|
|
|
|
| |
This reverts commit bf5ffb5fd8558bd799791834def431c0cee5a11f.
Cleanup of mount doesn't work the way it was envisioned, because the
kernel doesn't follow mounts on the umount() call, hence it will find
a non-mounted directory.
|
| |
|
|
|
|
|
| |
--no-canonicalize
Remove "legacy" util-linux support as missing --no-canonicalize cannot
be worked around in fuse.
|
| | |
|
| |
|
|
|
| |
In case of failure to add to /etc/mtab use same mountpoint for cleanup
as for mounting. Reported by Marc Deslauriers
|
Benjamin Barenblat
Robo Shimmer
Rostislav Skudnov
Jann Horn
Laszlo Boszormenyi (GCS)
Nikolaus Rath
Tomohiro Kusumi
admorgan
Josh Soref
Joerg Thalheim
Heiko Becker
Przemysław Pawełczyk
Miklos Szeredi
Daniel Thau
Olivier Blin
Anatol Pomozov
Reuben Hawkins
Max Krasnyansky
Laszlo Papp
Miklos Szeredi