xfsprogs: don't allow udisks to automount XFS filesystems with no prompt

The unending stream of syzbot bug reports and overwrought filing of CVEs
for corner case handling (i.e. things that distract from actual user
complaints) in XFS has generated all sorts of of overheated rhetoric
about how every bug is a Serious Security Issue(tm) because anyone can
craft a malicious filesystem on a USB stick, insert the stick into a
victim machine, and mount will trigger a bug in the kernel driver that
leads to some compromise or DoS or something.

I thought that nobody would be foolish enough to automount an XFS
filesystem.  What a fool I was!  It turns out that udisks can be told
that it's okay to automount things, and then GNOME will do exactly that.
Including mounting mangled XFS filesystems!

<delete angry rant about poor decisionmaking and armchair fs developers
blasting us on X while not actually doing any of the work>

Turn off /this/ idiocy by adding a udev rule to tell udisks not to
automount XFS filesystems.

This will not stop a logged in user from unwittingly inserting a
malicious storage device and pressing [mount] and getting breached.
This is not a substitute for a thorough audit.  This is not a substitute
for lklfuse.  This does not solve the general problem of in-kernel fs
drivers being a huge attack surface.  I just want a vacation from the
sh*tstorm of bad ideas and threat models that I never agreed to support.

v2: Add external logs to the list too, and document the var we set

Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Reviewed-by: Dave Chinner <dchinner@redhat.com>
Reviewed-by: Carlos Maiolino <cmaiolino@redhat.com>

diff --git a/configure.ac b/configure.ac
index db1ca6292b991777d0445b6d45fec004d4b74f1b..517d0a3ad9ad6b38df7bf1a3665a794b7967c11e 100644 (file)
--- a/configure.ac
+++ b/configure.ac
@@ -209,6 +209,7 @@ AC_HAVE_SG_IO
 AC_HAVE_HDIO_GETGEO
 AC_CONFIG_SYSTEMD_SYSTEM_UNIT_DIR
 AC_CONFIG_CROND_DIR
+AC_CONFIG_UDEV_RULE_DIR
 
 if test "$enable_blkid" = yes; then
 AC_HAVE_BLKID_TOPO

diff --git a/include/builddefs.in b/include/builddefs.in
index e0a2f3cbc954b062db85afb1be21d8d7707cdbe5..147c9b9866da0f51096aac6c0f4bffe5669a7847 100644 (file)
--- a/include/builddefs.in
+++ b/include/builddefs.in
@@ -126,6 +126,8 @@ HAVE_SYSTEMD = @have_systemd@
 SYSTEMD_SYSTEM_UNIT_DIR = @systemd_system_unit_dir@
 HAVE_CROND = @have_crond@
 CROND_DIR = @crond_dir@
+HAVE_UDEV = @have_udev@
+UDEV_RULE_DIR = @udev_rule_dir@
 HAVE_LIBURCU_ATOMIC64 = @have_liburcu_atomic64@
 
 GCCFLAGS = -funsigned-char -fno-strict-aliasing -Wall

diff --git a/m4/package_services.m4 b/m4/package_services.m4
index f2d888a099a1bbf3f24a2720a4b5588a54e9d58a..a683ddb93e0e9124e9b4eaebde7d700f90886727 100644 (file)
--- a/m4/package_services.m4
+++ b/m4/package_services.m4
@@ -75,3 +75,45 @@ AC_DEFUN([AC_CONFIG_CROND_DIR],
        AC_SUBST(have_crond)
        AC_SUBST(crond_dir)
 ])
+
+#
+# Figure out where to put udev rule files
+#
+AC_DEFUN([AC_CONFIG_UDEV_RULE_DIR],
+[
+       AC_REQUIRE([PKG_PROG_PKG_CONFIG])
+       AC_ARG_WITH([udev_rule_dir],
+         [AS_HELP_STRING([--with-udev-rule-dir@<:@=DIR@:>@],
+               [Install udev rules into DIR.])],
+         [],
+         [with_udev_rule_dir=yes])
+       AS_IF([test "x${with_udev_rule_dir}" != "xno"],
+         [
+               AS_IF([test "x${with_udev_rule_dir}" = "xyes"],
+                 [
+                       PKG_CHECK_MODULES([udev], [udev],
+                         [
+                               with_udev_rule_dir="$($PKG_CONFIG --variable=udev_dir udev)/rules.d"
+                         ], [
+                               with_udev_rule_dir=""
+                         ])
+                       m4_pattern_allow([^PKG_(MAJOR|MINOR|BUILD|REVISION)$])
+                 ])
+               AC_MSG_CHECKING([for udev rule dir])
+               udev_rule_dir="${with_udev_rule_dir}"
+               AS_IF([test -n "${udev_rule_dir}"],
+                 [
+                       AC_MSG_RESULT(${udev_rule_dir})
+                       have_udev="yes"
+                 ],
+                 [
+                       AC_MSG_RESULT(no)
+                       have_udev="no"
+                 ])
+         ],
+         [
+               have_udev="disabled"
+         ])
+       AC_SUBST(have_udev)
+       AC_SUBST(udev_rule_dir)
+])

diff --git a/scrub/Makefile b/scrub/Makefile
index aba14ed231007797a7d8ed839fd76fd23a9ee774..4ad547178332afbff760aba1795dc5110a95f1b7 100644 (file)
--- a/scrub/Makefile
+++ b/scrub/Makefile
@@ -28,6 +28,11 @@ endif
 
 endif  # scrub_prereqs
 
+UDEV_RULES = xfs.rules
+ifeq ($(HAVE_UDEV),yes)
+       INSTALL_SCRUB += install-udev
+endif
+
 HFILES = \
 common.h \
 counter.h \
@@ -146,6 +151,12 @@ install-scrub: default
        $(LTINSTALL) -m 755 $(LTCOMMAND) $(PKG_SBIN_DIR)
        $(INSTALL) -m 755 $(XFS_SCRUB_ALL_PROG) $(PKG_SBIN_DIR)
 
+install-udev: $(UDEV_RULES)
+       $(INSTALL) -m 755 -d $(UDEV_RULE_DIR)
+       for i in $(UDEV_RULES); do \
+               $(INSTALL) -m 644 $$i $(UDEV_RULE_DIR)/64-$$i; \
+       done
+
 install-dev:
 
 -include .dep

diff --git a/scrub/xfs.rules b/scrub/xfs.rules
new file mode 100644 (file)
index 0000000..c3f69b3
--- /dev/null
+++ b/scrub/xfs.rules
@@ -0,0 +1,13 @@
+# SPDX-License-Identifier: GPL-2.0-or-later
+#
+# Copyright (C) 2023 Oracle.  All rights reserved.
+# Author: Darrick J. Wong <djwong@kernel.org>
+#
+# Don't let udisks automount XFS filesystems without even asking a user.
+# This doesn't eliminate filesystems as an attack surface; it only prevents
+# evil maid attacks when all sessions are locked.
+#
+# According to http://storaged.org/doc/udisks2-api/latest/udisks.8.html,
+# supplying UDISKS_AUTO=0 here changes the HintAuto property of the block
+# device abstraction to mean "do not automatically start" (e.g. mount).
+SUBSYSTEM=="block", ENV{ID_FS_TYPE}=="xfs|xfs_external_log", ENV{UDISKS_AUTO}="0"