Last active
April 18, 2018 14:39
-
-
Save Wolf480pl/b87ff62b6adf9cc952d8bcb4d7612640 to your computer and use it in GitHub Desktop.
An example of why bind mounts are not considered separate filesystems by open_by_handle_at, and probably by NFS server
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
#!/bin/sh | |
# assumes running as root | |
mkdir /tmp/wolfhome2 | |
mount --bind /home/wolf480 /tmp/wolfhome2 | |
./handlejack /home/ otheruser/.bashrc /tmp/wolfhome2/ | |
# should print mountid and fd, then wait for keypress | |
# then spit out the otheruser's bashrc |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
#define _GNU_SOURCE | |
#include <sys/types.h> | |
#include <sys/stat.h> | |
#include <fcntl.h> | |
#include <stdio.h> | |
#include <unistd.h> | |
int main(int argc, char **argv) { | |
if (argc <= 3) { | |
fprintf(stderr, "%s <dir1> <path> <dir2>\n", argv[0]); | |
return 2; | |
} | |
int dir1 = open(argv[1], O_RDONLY); | |
if (dir1 < 0) { | |
perror("open dir1"); | |
return 1; | |
} | |
int dir2 = open(argv[3], O_RDONLY); | |
if (dir2 < 0) { | |
perror("open dir2"); | |
return 1; | |
} | |
int res; | |
char handleBytes[sizeof(struct file_handle) + MAX_HANDLE_SZ]; | |
struct file_handle *handle = (struct file_handle*) handleBytes; | |
handle->handle_bytes = sizeof(handleBytes) - sizeof(struct file_handle); | |
int mountid; | |
res = name_to_handle_at(dir1, argv[2], handle, &mountid, 0); | |
if (res < 0) { | |
perror("name_to_handle_at"); | |
return 1; | |
} | |
printf("mount: %d\n", mountid); | |
int fd = open_by_handle_at(dir2, handle, O_RDONLY); | |
if (fd < 0) { | |
perror("open_by_handle_at"); | |
return 1; | |
} | |
printf("fd: %d\n", fd); | |
getchar(); | |
char arg[64]; | |
snprintf(arg, sizeof(arg), "/dev/fd/%d", fd); | |
execlp("cat", "cat", arg); | |
perror("execlp failed"); | |
return 1; | |
} |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment