Sebastian Wick aa19390539 revokefs: Avoid symlink path traversal in chmod() ...

Use glnx_chaseat to ensure that all the attacker-controlled paths end up
inside the basefd directory, and then AT_SYMLINK_NOFOLLOW to make sure
that the last path component won't escape from the basefd.

On kernels >= 6.6 we can now use fchmodat() with AT_SYMLINK_NOFOLLOW,
but on older kernels that didn't work, so if necessary fall back to
opening the file with O_NOFOLLOW and then calling fchmod() on it.

Because this is the last syscall that used the previous (flawed)
validation mechanism, we can now remove the validation helpers and be
sure that everything is using the glnx-chaseat()-based replacements.

[smcv: Separated from a larger commit for better reviewability]
Co-authored-by: Simon McVittie <smcv@collabora.com>
Resolves: https://github.com/flatpak/flatpak/security/advisories/GHSA-qrwq-7qwx-q9rp

2026-08-10 23:06:17 +02:00

..

demo.c

Constify arrays of program arguments

2024-08-22 15:17:13 -03:00

main.c

revokefs: Clean up struct fuse_args with fuse_opt_free_args

2024-08-03 11:12:31 -05:00

meson.build

Add a Meson build system

2022-10-24 16:12:14 +01:00

writer.c

revokefs: Avoid symlink path traversal in chmod()

2026-08-10 23:06:17 +02:00

writer.h

revokefs: Use FUSE version 3 if possible

2022-08-16 13:27:04 +02:00