src/sys/fs/nullfs/null_vnops.c, branch stable/13FreeBSD source treehttps://cgit-dev.freebsd.org/src/atom?h=stable%2F132025-11-19T20:47:50Znamei: Make stackable filesystems check harder for jail roots2025-11-19T20:47:50ZMark Johnstonmarkj@FreeBSD.org2025-05-23T12:52:24Zurn:sha1:592de68e328b4edf8acdb2a0b0b66a813747b440
Suppose a process has its cwd pointing to a nullfs directory, where the
lower directory is also visible in the jail's filesystem namespace.
Suppose that the lower directory vnode is moved out from under the
nullfs mount. The nullfs vnode still shadows the lower vnode, and
dotdot lookups relative to that directory will instantiate new nullfs
vnodes outside of the nullfs mountpoint, effectively shadowing the lower
filesystem.
This phenomenon can be abused to escape a chroot, since the nullfs
vnodes instantiated by these dotdot lookups defeat the root vnode check
in vfs_lookup(), which uses vnode pointer equality to test for the
process root.
Fix this by extending nullfs and unionfs to perform the same check,
exploiting the fact that the passed componentname is embedded in a
nameidata structure to avoid changing the VOP_LOOKUP interface. That
is, add a flag to indicate that containerof can be used to get the full
nameidata structure, and perform the root vnode check on the lower vnode
when performing a dotdot lookup.
PR: 262180
Reviewed by: olce, kib
MFC after: 2 weeks
Differential Revision: https://reviews.freebsd.org/D50418
(cherry picked from commit 7587f6d4840f8d363e457cddc14c184cf1fe7cc1)
nullfs lookup: cn_flags is 64bit2025-11-19T20:47:50ZKonstantin Belousovkib@FreeBSD.org2025-05-17T05:37:48Zurn:sha1:19b91b15530d1ed0453ce073fb15d1f790ff85e4
Reviewed by: olce
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
Differential revision: https://reviews.freebsd.org/D50390
(cherry picked from commit 89549c2348170921cc4270ac95bfabfd78d42739)
nullfs: do not allow bypass on copy_file_range()2023-12-05T00:44:13ZKonstantin Belousovkib@FreeBSD.org2023-11-18T09:23:22Zurn:sha1:6c5e70a22c41bf3ebe3e9a68f1c9ac29775809fb
(cherry picked from commit 326836a1ebc6ce9b28c8f2bc1d177a444fba8ea6)
VFS: add VOP_GETLOWVNODE()2023-12-05T00:44:13ZKonstantin Belousovkib@FreeBSD.org2023-11-18T08:55:48Zurn:sha1:62ed7f98a2db5018a5336398df37f60cb157ec6d
(cherry picked from commit 4cbe4c48a7e574ec1bb919351d7a57d252b00b62)
sys: Remove $FreeBSD$: two-line .h pattern2023-08-23T17:43:20ZWarner Loshimp@FreeBSD.org2023-08-22T01:31:02Zurn:sha1:f8167e0404dab9ffeaca95853dd237ab7c587f82
Remove /^\s*\*\n \*\s+\$FreeBSD\$$\n/
Similar commit in current:
(cherry picked from commit 95ee2897e98f)
nullfs(5): Fix a typo in a source code comment2022-08-10T12:23:45ZGordon Berglinggbe@FreeBSD.org2022-08-07T12:04:53Zurn:sha1:d03a300ad781bc3105468b4308974b3a53e1ecb9
- s/examing/examining/
(cherry picked from commit 4c399b044fc66b02e37110ca5c1f4ce0e3beb9d1)
null_vptocnp(): busy nullfs mp instead of refing it2022-06-21T12:43:38ZKonstantin Belousovkib@FreeBSD.org2022-06-10T11:35:45Zurn:sha1:60dc4909a8969be38ca2bc60e9f9c8eeb62c7624
(cherry picked from commit 7fd37611b92b5f365f33435bb725b335c2f10ba8)
null_vput_pair(): release use reference on dvp earlier2021-08-14T10:21:59ZKonstantin Belousovkib@FreeBSD.org2021-03-07T21:08:38Zurn:sha1:94cb19f46114950586fc363b518550c171849291
(cherry picked from commit 16dea8341024b8ee8be619c27d4e63bd81bd9b6c)
nullfs: provide custom null_rename bypass2021-08-03T09:52:36ZKonstantin Belousovkib@FreeBSD.org2021-07-24T15:05:58Zurn:sha1:7f5a4aff9b4826c1b9852f949ef97fe7ecf3efb0
(cherry picked from commit 4eaf9609fe42878eccaaf5fe1873f792074a62e4)
null_rename: some style2021-08-03T09:52:36ZKonstantin Belousovkib@FreeBSD.org2021-07-24T14:46:51Zurn:sha1:5c52335fd1ccdd640134fe7b3dec7e8755e8d42c
(cherry picked from commit 26e72728ce12c8670894435fcef8055a0ecb6266)