nsswitch: do not reload if "/" changes

[Florian Weimer]

* DJ Delorie:

>> I have one remaining question: Should we load service modules after /
>> has changed?  Disabling reloading brings us back to the old behavior in
>> terms of exposure to untrusted /, but maybe we can do even better and
>> stop loading service modules altogether?  Assuming that this change is
>> compatible with init systems.
>
> This patch makes it "no worse than before" but I'm not sure we can make
> it better than before, because we have no hints that we're entering a
> container, and by the time we have, it's too late to load the right
> module.  The options become (1) don't load the module and definitely
> fail, or (2) maybe load the module in the container and work (and,
> depending on your app, open a security hole?) (which is the "old way").
>
> We would either need a new API that says "about to enter container" (or
> hack into the namespace syscalls) or at least dlopen all mentioned
> modules when we parse nsswitch.conf

Are you concerned with the case that there are no NSS calls before
entering the container, so that we don't initialize anything at all?

> +  /* Before we reload, verify that "/" hasn't changed.  We assume that
> +     errors here are very unlikely, but the chance that we're entering
> +     a container is also very unlikely, so we err on the side of both
> +     very unlikely things not happening at the same time.  */
> +  if (__stat64 ("/", &str) == 0)

Hmm.  Upon second thought, I think this need to be made fail-closed by
disabling reload on stat failure.  The two things aren't as unrelated as
one might think (chroot + truning on some security filter doesn't seem
to be uncommon).  Now of course it's a bit unlikely that anything can be
loaded later if / can't be read, but is there a harm in macking this
explicity?

Thanks,
Florian
-- 
Red Hat GmbH, https://de.redhat.com/ , Registered seat: Grasbrunn,
Commercial register: Amtsgericht Muenchen, HRB 153243,
Managing Directors: Charles Cachera, Brian Klemm, Laurie Krebs, Michael O'Neill