Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Race-condition when reading file content can access device nodes in reverse mode #187

Closed
slackner opened this issue Dec 8, 2017 · 0 comments

Comments

@slackner
Copy link
Contributor

slackner commented Dec 8, 2017

The general idea is similar to issue #165 that is already mostly fixed.

Steps to reproduce:

  1. Create a regular reverse mount point
  2. Create a file "test" in the original directory
  3. Access the corresponding encrypted directory in the mount point (ls <encrypted dir>)
  4. Quickly delete the file in the original data - instead create a device node
  5. Access the file again, it will access the device node and attempt to read from it

In practice the impact of this possible attack is relatively small because step 4 already requires root permissions. Nevertheless, if I don't miss anything the problem can be easily avoided by checking the file type using the handle after the OpenNofollow call. Actually, there already is an Fstat call in the corresponding function.

slackner added a commit to slackner/gocryptfs that referenced this issue Dec 11, 2017
Steps to reproduce:

* Create a regular reverse mount point
* Create a file "test" in the original directory
* Access the corresponding encrypted directory in the mount point (ls <encrypted dir>)
* Quickly delete the file in the original data - instead create a device node
* Access the file again, it will access the device node and attempt to read from it

Fixes rfjakob#187
rfjakob pushed a commit that referenced this issue Dec 11, 2017
Steps to reproduce:

* Create a regular reverse mount point
* Create a file "test" in the original directory
* Access the corresponding encrypted directory in the mount point (ls <encrypted dir>)
* Quickly delete the file in the original data - instead create a device node
* Access the file again, it will access the device node and attempt to read from it

Fixes #187
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant