Hacker News new | ask | show | jobs
by angry_octet 978 days ago
There would traditionally been another TOCTOU is the described solution, namely hardlinks. This can often be used to get root to do something to a file it shouldn't.

The trad solution is to have user writeable areas (home, vartmp, tmp) on different volumes. Some tools have options to not traverse symlinks across volumes for this and other reasons. But on modern systems you are protected by the fs.protected_hardlinks setting.

https://wiki.alpinelinux.org/wiki/Sysctl.conf
2 comments
tadfisher 978 days ago
Researching this, found [1]:

> POSIX guarantees that hard links can exist. It follows that, on POSIX systems without any non-standard protections, it's unsafe for anyone (but in particular, root) to do anything sensitive in a directory that is writable by another user. Cross-platform programs designed to do so are simply flawed.

I feel like something had to have been lost in translation from Unix to POSIX here. In the original implementation, were users able to hardlink (well, "link") files owned by others? If so, this is a foundational flaw that should probably be fixed across the board with something similar to Linux's non-standard sysctl option.

[1]: http://michael.orlitzky.com/articles/posix_hardlink_heartach...

link
angry_octet 978 days ago
Yes, normally you could hard link any file if you can read a directory that references it, and if there was a directory you had write access to on the same volume. The hard link doesn't change the permissions of the file.

Hard links are particularly useful for having multiple copies of a directory tree without consuming space for the files. Eg to create an overlay of a build tree, with your changes on top. Unfortunately CoW file systems still have many issues that make this difficult.

link
tedunangst 978 days ago
A link is just a directory entry. If you can write to the directory, you can create entries in it. And back in olden times, mkdir was setuid because it wasn't a syscall.
link
remram 978 days ago
Can a user make a hard link to a file they don't own? How does this attack work?
link
tadfisher 978 days ago
These links (pun unfortunate) should help:

https://sysctl-explorer.net/fs/protected_hardlinks/

http://michael.orlitzky.com/articles/posix_hardlink_heartach...

link
remram 977 days ago
Answer: fs.protected_hardlinks=1 is what prevents the creation of hardlinks to files you don't own. It's on by default on all machines I checked though.

https://github.com/torvalds/linux/commit/800179c9b8a1e796e44...

Without this, a whole lot of attacks are possible with hardlinks.

link