Subject: Re: kern/7129: normal user can bypass mount 'noexec' flags
To: Bill Studenmund <wrstuden@nas.nasa.gov>
From: Thor Lancelot Simon <tls@rek.tjls.com>
List: tech-security
Date: 03/11/1999 18:52:49
On Thu, Mar 11, 1999 at 03:28:30PM -0800, Bill Studenmund wrote:
> On Thu, 11 Mar 1999, Bill Sommerfeld wrote:
> 
> > Here's the interface I think makes sense for fixing this:
> > 
> >        VOP_GETMNTFLAGS(vp)
> > 
> > .. returns the ored-together mount flags of the filesystem vp and any
> > filesystems vp is stacked on..
> > 
> > implementation for "leaf" filesystems just looks in the vfs structure.
> > 
> > mount_null, etc., or's its bits together with the one of the
> > underlying vnode..
> 
> I think it would be simpler to just add the smarts into the mount
> commands. If each one along the way starts with the underlying fs's flags,
> adds ones it considers important, and only lets root delete flags, then we
> should be fine.

Um, that's how we got *in* this mess, at least with umapfs.  If you're going
to let non-root users mount filesystems, you *can't* just "add the smarts
into the mount commands".  The user can just build a mount command that
doesn't have the "smarts" in it, and you lose.  The smarts *have* to go in
the kernel.

-- 
Thor Lancelot Simon	                                      tls@rek.tjls.com
	"And where do all these highways go, now that we are free?"