Keep ACME ownership within filesystem boundary

Author: eldryoth

crates/fluxheim-acme/Cargo.toml

@@ -51,3 +51,6 @@ x509-parser = { version = "0.18.1", default-features = false }
 fluxheim-common = { path = "../fluxheim-common", features = ["test-support"] }
 proptest = "1.9.0"
 tokio = { version = "1.52.3", default-features = false, features = ["rt", "time"] }
+
+[target.'cfg(target_os = "linux")'.dev-dependencies]
+rustix = { version = "1.1.4", features = ["mount"] }

crates/fluxheim-acme/src/acme_directory.rs

@@ -40,18 +40,21 @@ pub(crate) fn reconcile_private_directory_subtree(
         })
         .collect::<io::Result<Vec<_>>>()?;
 
+    let boundary_device = rustix::fs::fstat(boundary_directory)?.st_dev;
     let mut directory = rustix::io::dup(boundary_directory)?;
     for name in components.into_iter().flatten() {
         match rustix::fs::mkdirat(&directory, name, private_directory_mode()) {
             Ok(()) | Err(rustix::io::Errno::EXIST) => {}
             Err(error) => return Err(error.into()),
         }
-        directory = rustix::fs::openat(
-            &directory,
-            name,
-            directory_open_flags(),
-            rustix::fs::Mode::empty(),
-        )?;
+        let next = open_reconciliation_descendant(&directory, name)?;
+        if rustix::fs::fstat(&next)?.st_dev != boundary_device {
+            return Err(io::Error::new(
+                io::ErrorKind::PermissionDenied,
+                "ACME managed directory target crosses a filesystem boundary",
+            ));
+        }
+        directory = next;
         rustix::fs::fchown(
             &directory,
             Some(rustix::fs::Uid::from_raw(owner.0)),
@@ -62,6 +65,38 @@ pub(crate) fn reconcile_private_directory_subtree(
     Ok(directory)
 }
 
+#[cfg(target_os = "linux")]
+fn open_reconciliation_descendant(
+    directory: &rustix::fd::OwnedFd,
+    name: &std::ffi::OsStr,
+) -> io::Result<rustix::fd::OwnedFd> {
+    rustix::fs::openat2(
+        directory,
+        name,
+        directory_open_flags(),
+        rustix::fs::Mode::empty(),
+        rustix::fs::ResolveFlags::BENEATH
+            | rustix::fs::ResolveFlags::NO_SYMLINKS
+            | rustix::fs::ResolveFlags::NO_MAGICLINKS
+            | rustix::fs::ResolveFlags::NO_XDEV,
+    )
+    .map_err(Into::into)
+}
+
+#[cfg(all(unix, not(target_os = "linux")))]
+fn open_reconciliation_descendant(
+    directory: &rustix::fd::OwnedFd,
+    name: &std::ffi::OsStr,
+) -> io::Result<rustix::fd::OwnedFd> {
+    rustix::fs::openat(
+        directory,
+        name,
+        directory_open_flags(),
+        rustix::fs::Mode::empty(),
+    )
+    .map_err(Into::into)
+}
+
 #[cfg(unix)]
 fn walk_directory(path: &Path, create: bool) -> io::Result<rustix::fd::OwnedFd> {
     let mut directory = rustix::fs::openat(
@@ -254,4 +289,57 @@ mod tests {
         assert_eq!(error.kind(), io::ErrorKind::InvalidInput);
         assert!(!outside.exists());
     }
+
+    #[cfg(target_os = "linux")]
+    #[test]
+    fn owned_directory_reconciliation_rejects_bind_mount() {
+        // Run only inside an isolated privileged mount namespace.
+        const ENABLED: &str = "FLUXHEIM_ACME_MOUNT_BOUNDARY_TEST";
+        if std::env::var_os(ENABLED).as_deref() != Some(std::ffi::OsStr::new("1")) {
+            eprintln!("privileged ACME mount-boundary test skipped");
+            return;
+        }
+        if !rustix::process::geteuid().is_root() {
+            panic!("privileged ACME mount-boundary test requires root");
+        }
+
+        use std::os::unix::fs::{MetadataExt as _, PermissionsExt as _};
+
+        struct BindMount(std::path::PathBuf);
+        impl Drop for BindMount {
+            fn drop(&mut self) {
+                let _ = rustix::mount::unmount(&self.0, rustix::mount::UnmountFlags::DETACH);
+            }
+        }
+
+        let root = fluxheim_common::test_support::unique_temp_path("acme-directory-mount");
+        let boundary = root.join("storage");
+        let mount_point = boundary.join("mounted");
+        let outside = root.join("outside");
+        std::fs::create_dir_all(&mount_point).unwrap();
+        std::fs::create_dir_all(&outside).unwrap();
+        std::fs::set_permissions(&outside, std::fs::Permissions::from_mode(0o755)).unwrap();
+        let original = std::fs::symlink_metadata(&outside).unwrap();
+        rustix::mount::mount_bind(&outside, &mount_point).unwrap();
+        let _mount = BindMount(mount_point.clone());
+
+        let boundary_directory = open_directory_no_symlinks(&boundary).unwrap();
+        assert!(
+            reconcile_private_directory_subtree(
+                &boundary,
+                &boundary_directory,
+                &mount_point.join("child"),
+                (65_534, 65_534),
+            )
+            .is_err()
+        );
+
+        let after = std::fs::symlink_metadata(&outside).unwrap();
+        assert_eq!((after.uid(), after.gid()), (original.uid(), original.gid()));
+        assert_eq!(
+            after.permissions().mode() & 0o777,
+            original.permissions().mode() & 0o777
+        );
+        assert!(!outside.join("child").exists());
+    }
 }

docs/certificate-renewal.md

@@ -75,7 +75,12 @@ descriptor for the nearest existing storage boundary. Every managed descendant
 is reopened relative to that descriptor and reconciled to the selected UID/GID
 and mode `0700`, including descendants left `root:root` by an interrupted prior
 handoff. Paths outside the recorded boundary are rejected before filesystem
-mutation, and ancestors above it are never re-owned.
+mutation, and ancestors above it are never re-owned. Linux requires
+`openat2(2)` support for root-run reconciliation and uses `RESOLVE_BENEATH`,
+`RESOLVE_NO_SYMLINKS`, `RESOLVE_NO_MAGICLINKS`, and `RESOLVE_NO_XDEV`; an older
+kernel fails closed rather than falling back. Other Unix platforms compare the
+opened boundary and descendant device identifiers before changing ownership or
+mode.
 
 ```bash
 fluxheim --config path/to/fluxheim.toml --check-tls-storage

release-notes/RELEASE_NOTES_1.7.9.md

@@ -47,7 +47,10 @@ products.
   descriptor and reconciles every managed descendant to the selected UID/GID
   through descriptor-relative, no-symlink traversal. Restart repairs
   intermediate `0700 root:root` directories left by an interrupted root-run
-  handoff, while outside-boundary targets fail before mutation.
+  handoff, while outside-boundary targets fail before mutation. Linux also
+  enforces `openat2(RESOLVE_NO_XDEV)` and other Unix platforms reject device-ID
+  changes before ownership mutation, preventing reconciliation through nested
+  mount points.
 - Managed ACME account generation now creates P-256 material in zeroizing
   RustCrypto secret/document types before importing it into Ring and retaining
   the durable copy in `sanitization::SecretVec`, removing the transient