6 ms·

Posix hardlink heartache

103 points by cristoperb 5y ago

wmanley 5y ago
See also: Ghosts of Unix past, part 4: High-maintenance designs: https://lwn.net/Articles/416494/ https://lwn.net/Articles/416494/ > While hard links are certainly a lesser evil than setuid, and there is little motivation to rid ourselves of them, they do serve to illustrate how a seemingly clever and useful design can have a range of side effects which can weigh heavily against the value that the design tries to bring.
- deleted 5y ago
  [deleted]
- dpbriggs 5y ago
  The comment section on that article is quite the time capsule.
tedunangst 5y ago
The usual defense is to keep user writable spaces on separate mount points, where in theory they may be able to link with each others' files, but not anything important. And then be mindful about whatever dumb script you run that mucks with permissions.
- viraptor 5y ago
  "others' files, but not anything important" reminded me of https://xkcd.com/1200/ https://xkcd.com/1200/ - user files are pretty much the only important thing in many scenarios.
  - tedunangst 5y ago
    Users have a trivial defense: set permissions to prevent others from seeing the files. System files tend to live in world readable directories.
bodhiandphysics 5y ago
This seems to me to be a bit of throwing out the baby with the bathwater... the problem isn’t links but rather setuid programs changing file permissions in user writable directories!
jra_samba 5y ago
No so much harlinks, but symlinks are a blight on the POSIX filesystem design. They have caused endless pain and suffering and so many, many CVE's. They need to be eliminated.
- matheusmoreira 5y ago
  They are so useful though.
- tryauuum 5y ago
  why can't they both be bad things? :) I once googled if there is a mount option to disable symlink creation, unfortunately there is no.
- zokula 5y ago
  A filesystem without symlinks is a crippled and dead filesystem.
bloak 5y ago
So, which systems allow hard links to directories?
- dfox 5y ago
  There is a difference between “allows hardlinks to directories to exists” and “allows user to straighforwardly create them”. As for existence most unix filesystems have exactly zero issue with that, while on systems that allow you to link(2) to directory you have to be root to do that. Hardlinks to directories not only break bunch of userspace expectations, but more importantly create a structure that cannot be unlink(2)ed (unlink(2) does not work on directories and rmdir(2) works only for directories with st_nlink==2). So even on systems that allow creation of that it is restricted to root.
- eqvinox 5y ago
  ~None. It breaks too many assumptions when you can have the file system tree loop around on itself.~ Edit: WTF, apparently it's a core Apple Time Capsule feature. Okay. Cool. Never touching that. Edit²: https://arstechnica.com/gadgets/2011/07/mac-os-x-10-7/12/ https://arstechnica.com/gadgets/2011/07/mac-os-x-10-7/12/ claims that hard links are actually hidden files(?) on HFS+: > One particularly scary example is the implementation of hard links on HFS+. To keep track of hard links, HFS+ creates a separate file for each hard link inside a hidden directory at the root level of the volume. Hidden directories are kind of creepy to begin with, but the real scare comes when you remember that Time Machine is implemented using hard links to avoid unnecessary data duplication.
  - dfox 5y ago
    HFS+ is still only somewhat extended HFS and the filesystem itself does not support hardlinks to anything. The support for hardlinks is simulated in upper layers which while being questionable design on its own somewhat alleviates the usual problems with directory hardlinks.
- masklinn 5y ago
  macOS. IIRC ln(1) can't create directory hardlinks, but link(2) allows it (on HFS+, directory hardlinks were not ported over to APFS). Directory hardlink support was originally added for time machine.
eqvinox 5y ago
I don't see how the security issues described in this article are really tied to hardlinks. If root is doing chmod/chown in a directory that is writable by untrusted users, the same untrusted users can also just remove or rename files. Is there any example that demonstrates an exploit specifically relying on hardlinks?
- dfox 5y ago
  You can link a file that is outside of that directory and thus get write access to that file. (Canonical example is linking /etc/passwd somewhere where you expect root to do chown -R you .)
- cristoperb 5y ago
  The author links to one example at the top of the article ("CVE-2017-18188: opentmpfiles root privilege escalation via recursive chown"): http://michael.orlitzky.com/cves/cve-2017-18188.xhtml http://michael.orlitzky.com/cves/cve-2017-18188.xhtml Apparently a user can create a hardlink to a sensitive root-owned file (like /etc/shadow) in a user-writable directory where they know a privileged process (in this case tmpfiles.d) will come along and chown it to the user, after which that user will own the sensitive file too.
  - Negitivefrags 5y ago
    Couldn’t they introduce the same security feature mentioned for symlinks? As in, make it so by default you can’t create a hard link to a file you don’t already have write access to?
    - tyingq 5y ago
      >Couldn’t they introduce the same security feature mentioned for symlinks? "The tmpfiles.d specification for the Z type more or less implies some kind of recursive chown. The spec heads off one type of vulnerability by saying that symlinks should not be followed; however, hard links are still a problem" https://github.com/OpenRC/opentmpfiles/issues/3 https://github.com/OpenRC/opentmpfiles/issues/3 >As in, make it so by default you can’t create a hard link to a file you don’t already have write access to? From the CVE: "when the fs.protected_hardlinks sysctl is turned off" A description of that: "When set to “1” hardlinks cannot be created by users if they do not already own the source file, or do not have read/write access to it."
deckard1 5y ago
I'd be curious to know what use case people have today for hardlinks, ever since symlinks became a thing. I've been using Linux for more than 20 years and the only case I've found is for rsync incremental backups (--link-dest option), which is great for doing backups to an external USB hard drive and saving space. But that's rather niche.
- gunapologist99 5y ago
  not so niche. That's a really terrific use for them. Hardlinks are hampered compared to symlinks because they can't be used for directories (which seems just a really silly limitation). It would be awesome to be able to roll up and mirror entire directory trees.
  - viraptor 5y ago
    With newer systems this can be often handled at the os level. Both xfs and btrfs support copy-on-write, so you can have the same effect just by doing "cp --reflink".
    - mjevans 5y ago
      Sometimes multiple writable entries for a single object are desirable. As an advanced feature there's plenty of room for abuse and footgun problems, but it's still occasionally, maybe even rarely, the correct tool for the job.
      - caspper69 5y ago
        Why would you just not so this in code? Why require the whole os at the scripting level require this?
      - bodhiandpysics1 5y ago
        What's more important are multiple readable entries for an object! And for those objects not to disapear unless the ref count on them is zero. The quintessential example is a library... By linking it into a directory the program has acccess to, you expose the library to the program. By using a hard link, you protect that library from being erased by another user
lifeisstillgood 5y ago
I am trying to work out the level of (useless?/unnecessary?) churn in the world of startups / digital transformation / world. So, yes the Internet is great - it connects what 5 billion adults now, and allows faster finding of the things you want etc. But there is soooo much ... of this stuff. I am guessing that "Digital marketing for the Rental market" means you have a house to let, and you want to list it with these people and their five competitors because you might miss out because who knows where one's audience really looks. Now we could talk about disaggregation of AiBnB as a positive thing, but really - no, lets not. What we can talk about is there is a bare minimum of cost / effort we can imagine here. Call it a Craigslist for the whole internet. Want to sell something - just find the right RDF tuple and list it. A search engine can find it and anyone searching for "house to rent in London" or "new pair trainers" will have a complete JSON list to walk through - sortable by price, location, availability etc etc. Now this is not something I think should exist, but if it did it would still have a cost to operate. But we could measure the unnecessary churn by comparing the actual cost (in people, dollars, time etc) of things like RentPath to this bare minimum. I expect there are Economics PhDs on this, but it struck me as interesting.
tryauuum 5y ago
good news is that fs.protected_hardlinks is enabled on debian and ubuntu
admax88q 5y ago
Does multi user posix really get much use still? And should it? The model is how old now and we're still finding vulnerabilities more or less by design. Computers are so cheap that almost everyone has one in their pocket, and most in the first world own 2-3. Multi user operating systems just don't seem relevant anymore.
- jimrandomh 5y ago
  Yes. One use case is application sandboxing; the users aren't separate people, but separate programs. Eg on Android, each app is a "user", and Linux filesystem permissions are used to control what the apps can do. But there are also a few instances where you still see the different-users-ssh-into-the-same-server model; for example that server might be controlling a cluster, and have users ssh'ing in to do otherwise-slow computations.
  - admax88q 5y ago
    Using users to sandbox processes is a hack that has never worked well and is only successful when combined with lots of other sandbox technologies such as jails, SELinix or AppArmor.
- tristan957 5y ago
  Yes. At my work, I have my own user that has access to every machine in our lab. On my own personal computer, I am the only user however.
- tryauuum 5y ago
  Yes. Virtual (shared) hosting is still a thing
Dayne 5y ago
Thanks for the Information... https://www.mcdvoice.app/ https://www.mcdvoice.app/
Dayne 5y ago
Thanks for information.. https://www.mcdvoice.app/ https://www.mcdvoice.app/

103 points by cristoperb 5y ago

See also: Ghosts of Unix past, part 4: High-maintenance designs: https://lwn.net/Articles/416494/ https://lwn.net/Articles/416494/ > While hard links are certainly a lesser evil than setuid, and there is little motivation to rid ourselves of them, they do serve to illustrate how a seemingly clever and useful design can have a range of side effects which can weigh heavily against the value that the design tries to bring.

deleted 5y ago
[deleted]
dpbriggs 5y ago
The comment section on that article is quite the time capsule.

tedunangst 5y ago

The usual defense is to keep user writable spaces on separate mount points, where in theory they may be able to link with each others' files, but not anything important. And then be mindful about whatever dumb script you run that mucks with permissions.

viraptor 5y ago
"others' files, but not anything important" reminded me of https://xkcd.com/1200/ https://xkcd.com/1200/ - user files are pretty much the only important thing in many scenarios.
- tedunangst 5y ago
  Users have a trivial defense: set permissions to prevent others from seeing the files. System files tend to live in world readable directories.

bodhiandphysics 5y ago

This seems to me to be a bit of throwing out the baby with the bathwater... the problem isn’t links but rather setuid programs changing file permissions in user writable directories!

jra_samba 5y ago

No so much harlinks, but symlinks are a blight on the POSIX filesystem design. They have caused endless pain and suffering and so many, many CVE's. They need to be eliminated.

matheusmoreira 5y ago
They are so useful though.
tryauuum 5y ago
why can't they both be bad things? :) I once googled if there is a mount option to disable symlink creation, unfortunately there is no.
zokula 5y ago
A filesystem without symlinks is a crippled and dead filesystem.

bloak 5y ago

So, which systems allow hard links to directories?

dfox 5y ago
There is a difference between “allows hardlinks to directories to exists” and “allows user to straighforwardly create them”. As for existence most unix filesystems have exactly zero issue with that, while on systems that allow you to link(2) to directory you have to be root to do that. Hardlinks to directories not only break bunch of userspace expectations, but more importantly create a structure that cannot be unlink(2)ed (unlink(2) does not work on directories and rmdir(2) works only for directories with st_nlink==2). So even on systems that allow creation of that it is restricted to root.
eqvinox 5y ago
~None. It breaks too many assumptions when you can have the file system tree loop around on itself.~ Edit: WTF, apparently it's a core Apple Time Capsule feature. Okay. Cool. Never touching that. Edit²: https://arstechnica.com/gadgets/2011/07/mac-os-x-10-7/12/ https://arstechnica.com/gadgets/2011/07/mac-os-x-10-7/12/ claims that hard links are actually hidden files(?) on HFS+: > One particularly scary example is the implementation of hard links on HFS+. To keep track of hard links, HFS+ creates a separate file for each hard link inside a hidden directory at the root level of the volume. Hidden directories are kind of creepy to begin with, but the real scare comes when you remember that Time Machine is implemented using hard links to avoid unnecessary data duplication.
- dfox 5y ago
  HFS+ is still only somewhat extended HFS and the filesystem itself does not support hardlinks to anything. The support for hardlinks is simulated in upper layers which while being questionable design on its own somewhat alleviates the usual problems with directory hardlinks.
masklinn 5y ago
macOS. IIRC ln(1) can't create directory hardlinks, but link(2) allows it (on HFS+, directory hardlinks were not ported over to APFS). Directory hardlink support was originally added for time machine.

eqvinox 5y ago

I don't see how the security issues described in this article are really tied to hardlinks. If root is doing chmod/chown in a directory that is writable by untrusted users, the same untrusted users can also just remove or rename files. Is there any example that demonstrates an exploit specifically relying on hardlinks?

dfox 5y ago
You can link a file that is outside of that directory and thus get write access to that file. (Canonical example is linking /etc/passwd somewhere where you expect root to do chown -R you .)
cristoperb 5y ago
The author links to one example at the top of the article ("CVE-2017-18188: opentmpfiles root privilege escalation via recursive chown"): http://michael.orlitzky.com/cves/cve-2017-18188.xhtml http://michael.orlitzky.com/cves/cve-2017-18188.xhtml Apparently a user can create a hardlink to a sensitive root-owned file (like /etc/shadow) in a user-writable directory where they know a privileged process (in this case tmpfiles.d) will come along and chown it to the user, after which that user will own the sensitive file too.
- Negitivefrags 5y ago
  Couldn’t they introduce the same security feature mentioned for symlinks? As in, make it so by default you can’t create a hard link to a file you don’t already have write access to?
  - tyingq 5y ago
    >Couldn’t they introduce the same security feature mentioned for symlinks? "The tmpfiles.d specification for the Z type more or less implies some kind of recursive chown. The spec heads off one type of vulnerability by saying that symlinks should not be followed; however, hard links are still a problem" https://github.com/OpenRC/opentmpfiles/issues/3 https://github.com/OpenRC/opentmpfiles/issues/3 >As in, make it so by default you can’t create a hard link to a file you don’t already have write access to? From the CVE: "when the fs.protected_hardlinks sysctl is turned off" A description of that: "When set to “1” hardlinks cannot be created by users if they do not already own the source file, or do not have read/write access to it."

deckard1 5y ago

I'd be curious to know what use case people have today for hardlinks, ever since symlinks became a thing. I've been using Linux for more than 20 years and the only case I've found is for rsync incremental backups (--link-dest option), which is great for doing backups to an external USB hard drive and saving space. But that's rather niche.

gunapologist99 5y ago
not so niche. That's a really terrific use for them. Hardlinks are hampered compared to symlinks because they can't be used for directories (which seems just a really silly limitation). It would be awesome to be able to roll up and mirror entire directory trees.
- viraptor 5y ago
  With newer systems this can be often handled at the os level. Both xfs and btrfs support copy-on-write, so you can have the same effect just by doing "cp --reflink".
  - mjevans 5y ago
    Sometimes multiple writable entries for a single object are desirable. As an advanced feature there's plenty of room for abuse and footgun problems, but it's still occasionally, maybe even rarely, the correct tool for the job.
    - caspper69 5y ago
      Why would you just not so this in code? Why require the whole os at the scripting level require this?
    - bodhiandpysics1 5y ago
      What's more important are multiple readable entries for an object! And for those objects not to disapear unless the ref count on them is zero. The quintessential example is a library... By linking it into a directory the program has acccess to, you expose the library to the program. By using a hard link, you protect that library from being erased by another user

lifeisstillgood 5y ago

I am trying to work out the level of (useless?/unnecessary?) churn in the world of startups / digital transformation / world. So, yes the Internet is great - it connects what 5 billion adults now, and allows faster finding of the things you want etc. But there is soooo much ... of this stuff. I am guessing that "Digital marketing for the Rental market" means you have a house to let, and you want to list it with these people and their five competitors because you might miss out because who knows where one's audience really looks. Now we could talk about disaggregation of AiBnB as a positive thing, but really - no, lets not. What we can talk about is there is a bare minimum of cost / effort we can imagine here. Call it a Craigslist for the whole internet. Want to sell something - just find the right RDF tuple and list it. A search engine can find it and anyone searching for "house to rent in London" or "new pair trainers" will have a complete JSON list to walk through - sortable by price, location, availability etc etc. Now this is not something I think should exist, but if it did it would still have a cost to operate. But we could measure the unnecessary churn by comparing the actual cost (in people, dollars, time etc) of things like RentPath to this bare minimum. I expect there are Economics PhDs on this, but it struck me as interesting.

tryauuum 5y ago

good news is that fs.protected_hardlinks is enabled on debian and ubuntu

admax88q 5y ago

Does multi user posix really get much use still? And should it? The model is how old now and we're still finding vulnerabilities more or less by design. Computers are so cheap that almost everyone has one in their pocket, and most in the first world own 2-3. Multi user operating systems just don't seem relevant anymore.

jimrandomh 5y ago
Yes. One use case is application sandboxing; the users aren't separate people, but separate programs. Eg on Android, each app is a "user", and Linux filesystem permissions are used to control what the apps can do. But there are also a few instances where you still see the different-users-ssh-into-the-same-server model; for example that server might be controlling a cluster, and have users ssh'ing in to do otherwise-slow computations.
- admax88q 5y ago
  Using users to sandbox processes is a hack that has never worked well and is only successful when combined with lots of other sandbox technologies such as jails, SELinix or AppArmor.
tristan957 5y ago
Yes. At my work, I have my own user that has access to every machine in our lab. On my own personal computer, I am the only user however.
tryauuum 5y ago
Yes. Virtual (shared) hosting is still a thing

Dayne 5y ago

Thanks for the Information... https://www.mcdvoice.app/ https://www.mcdvoice.app/

Dayne 5y ago

Thanks for information.. https://www.mcdvoice.app/ https://www.mcdvoice.app/