Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 585564 - sys-fs/fuse-2.9.6 with sys-kernel/hardened-sources and musl: realpath is restricted causing mount failure
Summary: sys-fs/fuse-2.9.6 with sys-kernel/hardened-sources and musl: realpath is rest...
Status: CONFIRMED
Alias: None
Product: Gentoo Linux
Classification: Unclassified
Component: Current packages (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Gentoo's Team for Core System packages
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2016-06-11 00:17 UTC by Aric Belsito
Modified: 2021-08-30 00:12 UTC (History)
4 users (show)

See Also:
Package list:
Runtime testing required: ---


Attachments
Patch from SF thread. (fuse-2.9.4-realpath.patch,630 bytes, patch)
2016-06-11 00:17 UTC, Aric Belsito
Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Aric Belsito 2016-06-11 00:17:39 UTC
Created attachment 437106 [details, diff]
Patch from SF thread.

musl implements realpath through analyzing the proc filesystem
grsec adds proc restrictions which blocks use of realpath in some cases.

As a result, FUSE is broken on musl with a grsec kernel. The thread argues that the provided patch causes a security issue.

See this thread:
https://sourceforge.net/p/fuse/mailman/message/33378384/
Comment 1 Anthony Basile gentoo-dev 2016-07-21 16:45:40 UTC
(In reply to Aric Belsito from comment #0)
> Created attachment 437106 [details, diff] [details, diff]
> Patch from SF thread.
> 
> musl implements realpath through analyzing the proc filesystem
> grsec adds proc restrictions which blocks use of realpath in some cases.
> 
> As a result, FUSE is broken on musl with a grsec kernel. The thread argues
> that the provided patch causes a security issue.
> 
> See this thread:
> https://sourceforge.net/p/fuse/mailman/message/33378384/

the musl + realpath issue is known.  right now as a work around you can relax proc restrictions, but i don't think upstream grsec should change anything.  i'm cc-ing them just so they are aware.  ping me back if there's any resolution on that thread.
Comment 2 PaX Team 2016-07-21 20:34:07 UTC
this is not PaX code but grsec so better CC spender on it ;).