Skip to content

Instantly share code, notes, and snippets.

@Wolf480pl
Last active April 18, 2018 14:39
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save Wolf480pl/b87ff62b6adf9cc952d8bcb4d7612640 to your computer and use it in GitHub Desktop.
Save Wolf480pl/b87ff62b6adf9cc952d8bcb4d7612640 to your computer and use it in GitHub Desktop.
An example of why bind mounts are not considered separate filesystems by open_by_handle_at, and probably by NFS server
#!/bin/sh
# assumes running as root
mkdir /tmp/wolfhome2
mount --bind /home/wolf480 /tmp/wolfhome2
./handlejack /home/ otheruser/.bashrc /tmp/wolfhome2/
# should print mountid and fd, then wait for keypress
# then spit out the otheruser's bashrc
#define _GNU_SOURCE
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <stdio.h>
#include <unistd.h>
int main(int argc, char **argv) {
if (argc <= 3) {
fprintf(stderr, "%s <dir1> <path> <dir2>\n", argv[0]);
return 2;
}
int dir1 = open(argv[1], O_RDONLY);
if (dir1 < 0) {
perror("open dir1");
return 1;
}
int dir2 = open(argv[3], O_RDONLY);
if (dir2 < 0) {
perror("open dir2");
return 1;
}
int res;
char handleBytes[sizeof(struct file_handle) + MAX_HANDLE_SZ];
struct file_handle *handle = (struct file_handle*) handleBytes;
handle->handle_bytes = sizeof(handleBytes) - sizeof(struct file_handle);
int mountid;
res = name_to_handle_at(dir1, argv[2], handle, &mountid, 0);
if (res < 0) {
perror("name_to_handle_at");
return 1;
}
printf("mount: %d\n", mountid);
int fd = open_by_handle_at(dir2, handle, O_RDONLY);
if (fd < 0) {
perror("open_by_handle_at");
return 1;
}
printf("fd: %d\n", fd);
getchar();
char arg[64];
snprintf(arg, sizeof(arg), "/dev/fd/%d", fd);
execlp("cat", "cat", arg);
perror("execlp failed");
return 1;
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment