diff options
| author |   David Howells <dhowells@redhat.com> | 2025-01-07 18:34:50 +0000 |
|---|---|---|
| committer |   Christian Brauner <brauner@kernel.org> | 2025-01-10 14:54:07 +0100 |
| commit | 3e914febd79a8d1a78ee6e67ff3fa4214d6d1d57 (patch) | |
| tree | c946b49553e9b25cf055f367afd6b7ea9a1c5e12 /fs/afs | |
| parent | afs: Make /afs/.<cell> as well as /afs/<cell> mountpoints (diff) | |
| download | wireguard-linux-3e914febd79a8d1a78ee6e67ff3fa4214d6d1d57.tar.xz wireguard-linux-3e914febd79a8d1a78ee6e67ff3fa4214d6d1d57.zip | |
afs: Add rootcell checks
Add some checks for the validity of the cell name. It's may get put into a
symlink, so preclude it containing any slashes or "..". Also disallow
starting/ending with a dot. This makes /afs/@cell/ as a symlink less of a
security risk.
Also disallow multiple setting of /proc/net/afs/rootcell for any given
network namespace. Once set, the value may not be changed. This makes it
easier to only create /afs/@cell and /afs/.@cell if there's a rootcell.
Signed-off-by: David Howells <dhowells@redhat.com>
Link: https://lore.kernel.org/r/20250107183454.608451-3-dhowells@redhat.com
cc: Marc Dionne <marc.dionne@auristor.com>
cc: linux-afs@lists.infradead.org
Signed-off-by: Christian Brauner <brauner@kernel.org>
Diffstat (limited to 'fs/afs')
| -rw-r--r-- | fs/afs/cell.c | 8 | ||||
| -rw-r--r-- | fs/afs/proc.c | 8 |
2 files changed, 15 insertions, 1 deletions
diff --git a/fs/afs/cell.c b/fs/afs/cell.c index 1aba6d4d03a9..cee42646736c 100644 --- a/fs/afs/cell.c +++ b/fs/afs/cell.c @@ -367,6 +367,14 @@ int afs_cell_init(struct afs_net *net, const char *rootcell) len = cp - rootcell; } + if (len == 0 || !rootcell[0] || rootcell[0] == '.' || rootcell[len - 1] == '.') + return -EINVAL; + if (memchr(rootcell, '/', len)) + return -EINVAL; + cp = strstr(rootcell, ".."); + if (cp && cp < rootcell + len) + return -EINVAL; + /* allocate a cell record for the root cell */ new_root = afs_lookup_cell(net, rootcell, len, vllist, false); if (IS_ERR(new_root)) { diff --git a/fs/afs/proc.c b/fs/afs/proc.c index 15eab053af6d..e7614f4f30c2 100644 --- a/fs/afs/proc.c +++ b/fs/afs/proc.c @@ -240,7 +240,13 @@ static int afs_proc_rootcell_write(struct file *file, char *buf, size_t size) /* determine command to perform */ _debug("rootcell=%s", buf); - ret = afs_cell_init(net, buf); + ret = -EEXIST; + inode_lock(file_inode(file)); + if (!net->ws_cell) + ret = afs_cell_init(net, buf); + else + printk("busy\n"); + inode_unlock(file_inode(file)); out: _leave(" = %d", ret); |