mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-10-28 07:13:34 +00:00
dab741e0e0
For mounts that have the new "nosymfollow" option, don't follow symlinks when resolving paths. The new option is similar in spirit to the existing "nodev", "noexec", and "nosuid" options, as well as to the LOOKUP_NO_SYMLINKS resolve flag in the openat2(2) syscall. Various BSD variants have been supporting the "nosymfollow" mount option for a long time with equivalent implementations. Note that symlinks may still be created on file systems mounted with the "nosymfollow" option present. readlink() remains functional, so user space code that is aware of symlinks can still choose to follow them explicitly. Setting the "nosymfollow" mount option helps prevent privileged writers from modifying files unintentionally in case there is an unexpected link along the accessed path. The "nosymfollow" option is thus useful as a defensive measure for systems that need to deal with untrusted file systems in privileged contexts. More information on the history and motivation for this patch can be found here: https://sites.google.com/a/chromium.org/dev/chromium-os/chromiumos-design-docs/hardening-against-malicious-stateful-data#TOC-Restricting-symlink-traversal Signed-off-by: Mattias Nissler <mnissler@chromium.org> Signed-off-by: Ross Zwisler <zwisler@google.com> Reviewed-by: Aleksa Sarai <cyphar@cyphar.com> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
48 lines
1.5 KiB
C
48 lines
1.5 KiB
C
/* SPDX-License-Identifier: GPL-2.0 */
|
|
#ifndef _LINUX_STATFS_H
|
|
#define _LINUX_STATFS_H
|
|
|
|
#include <linux/types.h>
|
|
#include <asm/statfs.h>
|
|
|
|
struct kstatfs {
|
|
long f_type;
|
|
long f_bsize;
|
|
u64 f_blocks;
|
|
u64 f_bfree;
|
|
u64 f_bavail;
|
|
u64 f_files;
|
|
u64 f_ffree;
|
|
__kernel_fsid_t f_fsid;
|
|
long f_namelen;
|
|
long f_frsize;
|
|
long f_flags;
|
|
long f_spare[4];
|
|
};
|
|
|
|
/*
|
|
* Definitions for the flag in f_flag.
|
|
*
|
|
* Generally these flags are equivalent to the MS_ flags used in the mount
|
|
* ABI. The exception is ST_VALID which has the same value as MS_REMOUNT
|
|
* which doesn't make any sense for statfs.
|
|
*/
|
|
#define ST_RDONLY 0x0001 /* mount read-only */
|
|
#define ST_NOSUID 0x0002 /* ignore suid and sgid bits */
|
|
#define ST_NODEV 0x0004 /* disallow access to device special files */
|
|
#define ST_NOEXEC 0x0008 /* disallow program execution */
|
|
#define ST_SYNCHRONOUS 0x0010 /* writes are synced at once */
|
|
#define ST_VALID 0x0020 /* f_flags support is implemented */
|
|
#define ST_MANDLOCK 0x0040 /* allow mandatory locks on an FS */
|
|
/* 0x0080 used for ST_WRITE in glibc */
|
|
/* 0x0100 used for ST_APPEND in glibc */
|
|
/* 0x0200 used for ST_IMMUTABLE in glibc */
|
|
#define ST_NOATIME 0x0400 /* do not update access times */
|
|
#define ST_NODIRATIME 0x0800 /* do not update directory access times */
|
|
#define ST_RELATIME 0x1000 /* update atime relative to mtime/ctime */
|
|
#define ST_NOSYMFOLLOW 0x2000 /* do not follow symlinks */
|
|
|
|
struct dentry;
|
|
extern int vfs_get_fsid(struct dentry *dentry, __kernel_fsid_t *fsid);
|
|
|
|
#endif
|