proc: checkSymlinkOvermount -> checkSubpathOvermount

The logic is not symlink-specific, and will be used for non-symlinks in
the O_PATH resolver.

Signed-off-by: Aleksa Sarai <[email protected]>

Author: cyphar

open_linux.go

@@ -88,7 +88,7 @@ func Reopen(handle *os.File, flags int) (*os.File, error) {
 	// [1]: Linux commit ee2e3f50629f ("mount: fix mounting of detached mounts
 	// onto targets that reside on shared mounts").
 	fdStr := strconv.Itoa(int(handle.Fd()))
-	if err := checkSymlinkOvermount(procRoot, procFdDir, fdStr); err != nil {
+	if err := checkSubpathOvermount(procRoot, procFdDir, fdStr); err != nil {
 		return nil, fmt.Errorf("check safety of /proc/thread-self/fd/%s magiclink: %w", fdStr, err)
 	}
 

procfs_linux.go

@@ -347,7 +347,7 @@ func getMountID(dir *os.File, path string) (uint64, error) {
 	return stx.Mnt_id, nil
 }
 
-func checkSymlinkOvermount(procRoot *os.File, dir *os.File, path string) error {
+func checkSubpathOvermount(procRoot *os.File, dir *os.File, path string) error {
 	// Get the mntID of our procfs handle.
 	expectedMountID, err := getMountID(procRoot, "")
 	if err != nil {
@@ -363,7 +363,7 @@ func checkSymlinkOvermount(procRoot *os.File, dir *os.File, path string) error {
 	// using unsafeHostProcRoot() then an attaker could change this after we
 	// did this check.)
 	if expectedMountID != gotMountID {
-		return fmt.Errorf("%w: symlink %s/%s has an overmount obscuring the real link (mount ids do not match %d != %d)", errUnsafeProcfs, dir.Name(), path, expectedMountID, gotMountID)
+		return fmt.Errorf("%w: subpath %s/%s has an overmount obscuring the real link (mount ids do not match %d != %d)", errUnsafeProcfs, dir.Name(), path, expectedMountID, gotMountID)
 	}
 	return nil
 }
@@ -386,7 +386,7 @@ func doRawProcSelfFdReadlink(procRoot *os.File, fd int) (string, error) {
 	//
 	// [1]: Linux commit ee2e3f50629f ("mount: fix mounting of detached mounts
 	// onto targets that reside on shared mounts").
-	if err := checkSymlinkOvermount(procRoot, procFdLink, ""); err != nil {
+	if err := checkSubpathOvermount(procRoot, procFdLink, ""); err != nil {
 		return "", fmt.Errorf("check safety of /proc/thread-self/fd/%d magiclink: %w", fd, err)
 	}
 

procfs_linux_test.go

@@ -114,7 +114,7 @@ func testProcOvermountSubdir(t *testing.T, procRootFn procRootFunc, expectOvermo
 				// moved to libpathrs.
 				{"/proc/self/sched", "attr/current", "", unix.MS_BIND},
 				// Bind-mounts on top of symlinks should be detected by
-				// checkSymlinkOvermount.
+				// checkSubpathOvermount.
 				{"/proc/1/fd/0", "exe", "", unix.MS_BIND},
 				{"/proc/1/exe", "fd/0", "", unix.MS_BIND},
 				// TODO: Add a test for mounting on top of /proc/self or
@@ -150,7 +150,7 @@ func testProcOvermountSubdir(t *testing.T, procRootFn procRootFunc, expectOvermo
 		defer closer()
 
 		// Open these paths directly to emulate a non-openat2 handle that
-		// didn't detect a bind-mount to check that checkSymlinkOvermount works
+		// didn't detect a bind-mount to check that checkSubpathOvermount works
 		// properly for AT_EMPTY_PATH checks as well.
 		procCwd, err := openatFile(procSelf, "cwd", unix.O_PATH|unix.O_NOFOLLOW|unix.O_CLOEXEC, 0)
 		require.NoError(t, err)
@@ -160,14 +160,14 @@ func testProcOvermountSubdir(t *testing.T, procRootFn procRootFunc, expectOvermo
 		defer procExe.Close() //nolint:errcheck // test code
 
 		// no overmount
-		err = checkSymlinkOvermount(procRoot, procCwd, "")
+		err = checkSubpathOvermount(procRoot, procCwd, "")
 		assert.NoError(t, err, "checking /proc/self/cwd with no overmount should succeed") //nolint:testifylint // this is an isolated operation so we can continue despite an error
-		err = checkSymlinkOvermount(procRoot, procSelf, "cwd")
+		err = checkSubpathOvermount(procRoot, procSelf, "cwd")
 		assert.NoError(t, err, "checking /proc/self/cwd with no overmount should succeed") //nolint:testifylint // this is an isolated operation so we can continue despite an error
 		// basic overmount
-		err = checkSymlinkOvermount(procRoot, procExe, "")
+		err = checkSubpathOvermount(procRoot, procExe, "")
 		assert.ErrorIs(t, err, symlinkOvermountErr, "unexpected /proc/self/exe overmount result") //nolint:testifylint // this is an isolated operation so we can continue despite an error
-		err = checkSymlinkOvermount(procRoot, procSelf, "exe")
+		err = checkSubpathOvermount(procRoot, procSelf, "exe")
 		assert.ErrorIs(t, err, symlinkOvermountErr, "unexpected /proc/self/exe overmount result") //nolint:testifylint // this is an isolated operation so we can continue despite an error
 
 		// fd no overmount