Filesystem mounts in user namespaces — one year later [LWN.net]

Filesystem mounts in user namespaces — one year later

Posted Aug 18, 2016 8:57 UTC (Thu) by vegard (subscriber, #52330)
Parent article: Filesystem mounts in user namespaces — one year later

> Most Linux filesystems are simply not designed to be robust in the face of deliberately hostile on-disk filesystem images.

> Hardening filesystems against attacks from below is not a simple matter; such hardening has never been a design goal for the filesystems in common use.

We're still working on getting our filesystem fuzzing-with-AFL code out (http://lwn.net/Articles/685182/) but currently it does not take more than a few hours to find kernel-crashing bugs in any of the most widely used filesystems (ext4, xfs, btrfs, etc.). Several other filesystems crash in a matter of seconds under our AFL-based fuzzer.

I've looked more closely at ext4 myself and trying to fix the bugs that came up (http://lists.openwall.net/linux-ext4/2016/07/14/5, http://www.spinics.net/lists/linux-ext4/msg53166.html) and Bo Liu has been fixing quite a few bugs in btrfs. Other filesystems are on the roadmap but the sheer volume of issues means we don't have the manpower/bandwidth to fix everything at once.

Even so, these are only the bugs found by fuzzing. I can't find the link right now but I think there was a paper where somebody deliberately inserted bugs in the code and tried to discover them with coverage-guided fuzzing and it still only found some 10% of the bugs.

In light of all this, I would be extremely wary of enabling unprivileged mounts. Automatic mounting of external media (still enabled by default on most desktop distros) is already quite bad enough.

to post comments

Filesystem mounts in user namespaces — one year later

Posted Aug 20, 2016 23:48 UTC (Sat) by ebiederm (subscriber, #35028) [Link]

The primary target for now remains fuse.

We may be able to support other filesystems eventually but fuse should be supportable now.
Do you have any fuzz testing with respect to fuse?

The work of handling the odd cases was performed with respect to the vfs and not fuse as the necessary changes are cleaner and more obvious that way.

Fuse presents a very interesting case as it allows isolating the filesystem code in userspace while still allowing that code to be used by all programs through the vfs.

Fuse can support all of the popular filesystems today, and as such provides a safer alternative to mounting filesystems on usb sticks. The user namespace mount aspect of this just this all more usable.