Bug 585564

Summary:	sys-fs/fuse-2.9.6 with sys-kernel/hardened-sources and musl: realpath is restricted causing mount failure
Product:	Gentoo Linux	Reporter:	Aric Belsito <lluixhi>
Component:	Current packages	Assignee:	Gentoo's Team for Core System packages <base-system>
Status:	CONFIRMED ---
Severity:	normal	CC:	hardened, musl, pageexec, spender
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
Whiteboard:
Package list:		Runtime testing required:	---
Attachments:	Patch from SF thread.

Description Aric Belsito 2016-06-11 00:17:39 UTC

Created attachment 437106 [details, diff]
Patch from SF thread.

musl implements realpath through analyzing the proc filesystem
grsec adds proc restrictions which blocks use of realpath in some cases.

As a result, FUSE is broken on musl with a grsec kernel. The thread argues that the provided patch causes a security issue.

See this thread:
https://sourceforge.net/p/fuse/mailman/message/33378384/

Comment 1 Anthony Basile gentoo-dev

2016-07-21 16:45:40 UTC

(In reply to Aric Belsito from comment #0)
> Created attachment 437106 [details, diff] [details, diff]
> Patch from SF thread.
> 
> musl implements realpath through analyzing the proc filesystem
> grsec adds proc restrictions which blocks use of realpath in some cases.
> 
> As a result, FUSE is broken on musl with a grsec kernel. The thread argues
> that the provided patch causes a security issue.
> 
> See this thread:
> https://sourceforge.net/p/fuse/mailman/message/33378384/

the musl + realpath issue is known.  right now as a work around you can relax proc restrictions, but i don't think upstream grsec should change anything.  i'm cc-ing them just so they are aware.  ping me back if there's any resolution on that thread.

Comment 2 PaX Team 2016-07-21 20:34:07 UTC

this is not PaX code but grsec so better CC spender on it ;).