5 ms·

There would traditionally been another TOCTOU is the described solution, namely hardlinks. This can often be used to get root to do something to a file it shoul

There would traditionally been another TOCTOU is the described solution, namely hardlinks. This can often be used to get root to do something to a file it shouldn't. The trad solution is to have user writeable areas (home, vartmp, tmp) on different volumes. Some tools have options to not traverse symlinks across volumes for this and other reasons. But on modern systems you are protected by the fs.protected_hardlinks setting. https://wiki.alpinelinux.org/wiki/Sysctl.conf https://wiki.alpinelinux.org/wiki/Sysctl.conf

remram 3y ago
Can a user make a hard link to a file they don't own? How does this attack work?
- tadfisher 3y ago
  These links (pun unfortunate) should help: https://sysctl-explorer.net/fs/protected_hardlinks/ https://sysctl-explorer.net/fs/protected_hardlinks/ http://michael.orlitzky.com/articles/posix_hardlink_heartache.xhtml http://michael.orlitzky.com/articles/posix_hardlink_heartach...
- remram 3y ago
  Answer: fs.protected_hardlinks=1 is what prevents the creation of hardlinks to files you don't own. It's on by default on all machines I checked though. https://github.com/torvalds/linux/commit/800179c9b8a1e796e441674776d11cd4c05d61d7 https://github.com/torvalds/linux/commit/800179c9b8a1e796e44... Without this, a whole lot of attacks are possible with hardlinks.
tadfisher 3y ago
Researching this, found [1]: > POSIX guarantees that hard links can exist. It follows that, on POSIX systems without any non-standard protections, it's unsafe for anyone (but in particular, root) to do anything sensitive in a directory that is writable by another user. Cross-platform programs designed to do so are simply flawed. I feel like something had to have been lost in translation from Unix to POSIX here. In the original implementation, were users able to hardlink (well, "link") files owned by others? If so, this is a foundational flaw that should probably be fixed across the board with something similar to Linux's non-standard sysctl option. [1]: http://michael.orlitzky.com/articles/posix_hardlink_heartache.xhtml http://michael.orlitzky.com/articles/posix_hardlink_heartach...
- tedunangst 3y ago
  A link is just a directory entry. If you can write to the directory, you can create entries in it. And back in olden times, mkdir was setuid because it wasn't a syscall.
- angry_octet 3y ago
  Yes, normally you could hard link any file if you can read a directory that references it, and if there was a directory you had write access to on the same volume. The hard link doesn't change the permissions of the file. Hard links are particularly useful for having multiple copies of a directory tree without consuming space for the files. Eg to create an overlay of a build tree, with your changes on top. Unfortunately CoW file systems still have many issues that make this difficult.

remram 3y ago

Can a user make a hard link to a file they don't own? How does this attack work?

tadfisher 3y ago
These links (pun unfortunate) should help: https://sysctl-explorer.net/fs/protected_hardlinks/ https://sysctl-explorer.net/fs/protected_hardlinks/ http://michael.orlitzky.com/articles/posix_hardlink_heartache.xhtml http://michael.orlitzky.com/articles/posix_hardlink_heartach...
remram 3y ago
Answer: fs.protected_hardlinks=1 is what prevents the creation of hardlinks to files you don't own. It's on by default on all machines I checked though. https://github.com/torvalds/linux/commit/800179c9b8a1e796e441674776d11cd4c05d61d7 https://github.com/torvalds/linux/commit/800179c9b8a1e796e44... Without this, a whole lot of attacks are possible with hardlinks.

tadfisher 3y ago

Researching this, found [1]: > POSIX guarantees that hard links can exist. It follows that, on POSIX systems without any non-standard protections, it's unsafe for anyone (but in particular, root) to do anything sensitive in a directory that is writable by another user. Cross-platform programs designed to do so are simply flawed. I feel like something had to have been lost in translation from Unix to POSIX here. In the original implementation, were users able to hardlink (well, "link") files owned by others? If so, this is a foundational flaw that should probably be fixed across the board with something similar to Linux's non-standard sysctl option. [1]: http://michael.orlitzky.com/articles/posix_hardlink_heartache.xhtml http://michael.orlitzky.com/articles/posix_hardlink_heartach...

tedunangst 3y ago
A link is just a directory entry. If you can write to the directory, you can create entries in it. And back in olden times, mkdir was setuid because it wasn't a syscall.
angry_octet 3y ago
Yes, normally you could hard link any file if you can read a directory that references it, and if there was a directory you had write access to on the same volume. The hard link doesn't change the permissions of the file. Hard links are particularly useful for having multiple copies of a directory tree without consuming space for the files. Eg to create an overlay of a build tree, with your changes on top. Unfortunately CoW file systems still have many issues that make this difficult.