When running in a container with a user namespace, if you call getxattr
with name = "system.posix_acl_access" and size % 8 != 4, then getxattr
silently skips the user namespace fixup that it normally does resulting in
un-fixed-up data being returned.
This is caused by posix_acl_fix_xattr_to_user() being passed the total
buffer size and not the actual size of the xattr as returned by
vfs_getxattr().
I have pushed a commit upstream that fixes this bug:
/* Run in user namespace with nsuid 0 mapped to uid != 0 on the host. */
int main(int argc, void **argv)
{
ssize_t ret1, ret2;
char buf1[128], buf2[132];
int fret = EXIT_SUCCESS;
char *file;
if (argc < 2) { fprintf(stderr, "Please specify a file with " "\"system.posix_acl_access\" permissions set\n"); _exit(EXIT_FAILURE);
}
file = argv[1];
if (ret1 != ret2) { fprintf(stderr, "The value of \"system.posix_acl_" "access\" for file \"%s\" changed " "between two successive calls\n", file); _exit(EXIT_FAILURE);
}
for (ssize_t i = 0; i < ret2; i++) { if (buf1[i] == buf2[i]) continue;
fprintf(stderr, "Unexpected different in byte %zd: " "%02x != %02x\n", i, buf1[i], buf2[i]); fret = EXIT_FAILURE;
}
On a non-fixed up kernel this should return something like:
root@c1:/# ./t
Unexpected different in byte 16: ffffffa0 != 00
Unexpected different in byte 17: ffffff86 != 00
Unexpected different in byte 18: 01 != 00
and on a fixed kernel:
root@c1:~# ./t
Test passed
Please backport this to the 4.15 (bionic) and 4.4 (xenial) kernels. :)
Hey everyone,
When running in a container with a user namespace, if you call getxattr posix_acl_ access" and size % 8 != 4, then getxattr fix_xattr_ to_user( ) being passed the total
with name = "system.
silently skips the user namespace fixup that it normally does resulting in
un-fixed-up data being returned.
This is caused by posix_acl_
buffer size and not the actual size of the xattr as returned by
vfs_getxattr().
I have pushed a commit upstream that fixes this bug:
https:/ /git.kernel. org/pub/ scm/linux/ kernel/ git/torvalds/ linux.git/ commit/ ?id=82c9a927bc5 df6e06b72d206d2 4a9d10cced4eb5
This commit passes the actual length of the xattr as returned by
vfs_getxattr() down.
A reproducer for the issue is:
touch acl_posix
setfacl -m user:0:rwx acl_posix
and the compile:
#define _GNU_SOURCE
#include <errno.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/types.h>
#include <unistd.h>
#include <attr/xattr.h>
/* Run in user namespace with nsuid 0 mapped to uid != 0 on the host. */
int main(int argc, void **argv)
{
ssize_t ret1, ret2;
char buf1[128], buf2[132];
int fret = EXIT_SUCCESS;
char *file;
if (argc < 2) {
fprintf( stderr,
"Please specify a file with "
"\ "system. posix_acl_ access\ " permissions set\n");
_exit( EXIT_FAILURE) ;
}
file = argv[1];
ret1 = getxattr(file, "system. posix_acl_ access" ,
buf1, sizeof(buf1));
fprintf( stderr, "%s - Failed to retrieve "
" \"system. posix_acl_ access\ " "
" from \"%s\"\n", strerror(errno), file);
_exit( EXIT_FAILURE) ;
if (ret1 < 0) {
}
ret2 = getxattr(file, "system. posix_acl_ access" ,
buf2, sizeof(buf2));
fprintf( stderr, "%s - Failed to retrieve "
" \"system. posix_acl_ access\ " "
" from \"%s\"\n", strerror(errno), file);
_exit( EXIT_FAILURE) ;
if (ret2 < 0) {
}
if (ret1 != ret2) {
fprintf( stderr, "The value of \"system. posix_acl_ "
" access\ " for file \"%s\" changed "
" between two successive calls\n", file);
_exit( EXIT_FAILURE) ;
}
for (ssize_t i = 0; i < ret2; i++) {
if (buf1[i] == buf2[i])
continue;
}
if (fret == EXIT_SUCCESS)
fprintf( stderr, "Test passed\n");
fprintf( stderr, "Test failed\n");
else
}
and run:
./tester acl_posix
On a non-fixed up kernel this should return something like:
root@c1:/# ./t
Unexpected different in byte 16: ffffffa0 != 00
Unexpected different in byte 17: ffffff86 != 00
Unexpected different in byte 18: 01 != 00
and on a fixed kernel:
root@c1:~# ./t
Test passed
Please backport this to the 4.15 (bionic) and 4.4 (xenial) kernels. :)
Thanks!
Christian