Btrfs receive hardening patches

Commit Message

lauri April 13, 2015, 11:13 a.m. UTC

Hello,

due to security reasons in certain usecases it would be nice to force
btrfs receive to confine itself to the directory of subvolume. I've
attached a patch that issues chroot before parsing btrfs stream. Let
me know if this breaks anything, preliminary tests showed it performed
as expected. If necessary I can make this functionality optional via
command-line flag.

Patch

diff --git a/cmds-receive.c b/cmds-receive.c
index 44ef27e..e03acdd 100644
--- a/cmds-receive.c
+++ b/cmds-receive.c
@@ -867,15 +867,20 @@  static int do_receive(struct btrfs_receive *r, const char *tomnt, int r_fd,
 		goto out;
 	}
 
-	/*
-	 * find_mount_root returns a root_path that is a subpath of
-	 * dest_dir_full_path. Now get the other part of root_path,
-	 * which is the destination dir relative to root_path.
+
+	/**
+	 * Nasty hack to enforce chroot before parsing btrfs stream
 	 */
-	r->dest_dir_path = dest_dir_full_path + strlen(r->root_path);
-	while (r->dest_dir_path[0] == '/')
-		r->dest_dir_path++;
+	if (chroot(dest_dir_full_path)) {
+		fprintf(stderr,
+			"ERROR: failed to chroot to %s\n",
+			dest_dir_full_path);
+		ret = -EINVAL;
+		goto out;
+	}
 
+	r->root_path = r->dest_dir_path = strdup("/");
+	
 	ret = subvol_uuid_search_init(r->mnt_fd, &r->sus);
 	if (ret < 0)
 		goto out;