#1027833 user-mode-linux: hostfs directory traversal

Package:
user-mode-linux
Source:
user-mode-linux
Description:
User-mode Linux (kernel)
Submitter:
Jakub Wilk
Date:
2023-02-07 21:45:03 UTC
Severity:
normal
Tags:
#1027833#3
Date:
2023-01-03 21:28:15 UTC
From:
To:
The man page says that hostfs kernel param is "used to confine all
hostfs mounts to within the specified directory tree on the host". But
it's trivial to escape this confinements with ../ sequences:

   # mount none -t hostfs -o ../../../../../../../../home/bob/secrets /mnt
#1027833#8
Date:
2023-01-10 13:13:00 UTC
From:
To:
Hello Jakub,

Could you please share the kernel command line option passed to the
running uml instance ?
#1027833#11
Date:
2023-01-11 17:39:57 UTC
From:
To:
* Ritesh Raj Sarraf <rrs@debian.org>, 2023-01-10 18:43:

I used with something like this:

    $ linux hostfs=/srv/chroots/unstable-i386/ rootfstype=hostfs init=/bin/sh quiet
#1027833#16
Date:
2023-01-20 11:29:14 UTC
From:
To:
Hello Jakub,


I think the manpage is misleading. Note that the manpage was especially
prepared for Debian and was last touched many years ago. I only looked
for its correctness now, now that you reported of it.

The current upstream documentation does warn about the functionality,
and does not advertise anything about confining the namespace.

I will try to fix it in time for Bookworm. Otherwise patches welcome.

The latest up-to-date documentation is available in the kernel sources
at: Documentation/virt/uml/user_mode_linux_howto_v2.rst

To quote from the documentation:

Host file access
==================

If you want to access files on the host machine from inside UML, you
can treat it as a separate machine and either nfs mount directories
from the host or copy files into the virtual machine with scp.
However, since UML is running on the host, it can access those
files just like any other process and make them available inside the
virtual machine without the need to use the network.
This is possible with the hostfs virtual filesystem.  With it, you
can mount a host directory into the UML filesystem and access the
files contained in it just as you would on the host.

*SECURITY WARNING*

Hostfs without any parameters to the UML Image will allow the image
to mount any part of the host filesystem and write to it. Always
confine hostfs to a specific "harmless" directory (for example ``/var/tmp``)
if running UML. This is especially important if UML is being run as root.
#1027833#19
Date:
2023-02-07 21:44:23 UTC
From:
To:
* Ritesh Raj Sarraf <rrs@debian.org>, 2023-01-20 16:59:

Er, but it does talk about confinement: