Bugtraq: Re: /proc filesystem allows bypassing directory permissions on

[Gabor Gombas <gombasg () sztaki hu>]

On Tue, Nov 03, 2009 at 12:33:28AM +0100, Martin Rex wrote:

> > "mount --bind" behaves like a hard link and it does not increment the link
> > count.
> that seems to work similar to a hardlink on a directory (and also requires
> root privileges).  It doesn't work for the same directory level, because
> of this (the directory permissions of the mounted directories and
> directories below it remain effective -- the permissions of directories
> above disappear, however!
I was speaking about single file bind-mounts, not directories.

# touch /tmp/a
# mount --bind /etc/passwd /tmp/a
# ls -l /etc/passwd
-rw-r--r-- 1 root root 1990 2009-08-24 16:22 /etc/passwd
# cat /tmp/a
root:x:0:0:root:/root:/bin/bash
[...]

Two references to the same inode, yet the link count is 1 and /proc is
nowhere in the picture.

Gabor

-- 
     ---------------------------------------------------------
     MTA SZTAKI Computer and Automation Research Institute
                Hungarian Academy of Sciences
     ---------------------------------------------------------