Hello,
due to security reasons in certain usecases it would be nice to force
btrfs receive to confine itself to the directory of subvolume. I've
attached a patch that issues chroot before parsing btrfs stream. Let
me know if this breaks anything, preliminary tests showed it performed
as expected. If necessary I can make this functionality optional via
command-line flag.
--
Lauri Võsandi
tel: +372 53329412
e-mail: lauri.vosandi@xxxxxxxxx
blog: http://lauri.vosandi.com/
diff --git a/cmds-receive.c b/cmds-receive.c
index 44ef27e..e03acdd 100644
--- a/cmds-receive.c
+++ b/cmds-receive.c
@@ -867,15 +867,20 @@ static int do_receive(struct btrfs_receive *r, const char *tomnt, int r_fd,
goto out;
}
- /*
- * find_mount_root returns a root_path that is a subpath of
- * dest_dir_full_path. Now get the other part of root_path,
- * which is the destination dir relative to root_path.
+
+ /**
+ * Nasty hack to enforce chroot before parsing btrfs stream
*/
- r->dest_dir_path = dest_dir_full_path + strlen(r->root_path);
- while (r->dest_dir_path[0] == '/')
- r->dest_dir_path++;
+ if (chroot(dest_dir_full_path)) {
+ fprintf(stderr,
+ "ERROR: failed to chroot to %s\n",
+ dest_dir_full_path);
+ ret = -EINVAL;
+ goto out;
+ }
+ r->root_path = r->dest_dir_path = strdup("/");
+
ret = subvol_uuid_search_init(r->mnt_fd, &r->sus);
if (ret < 0)
goto out;
