linux-kernel - Re: [uml-devel] [PATCH 04/10] uml: make execvp safe for our usage

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Sat, 21 Oct 2006 02:11:28 +0200
From:	Blaisorblade <blaisorblade@...oo.it>
To:	Jeff Dike <jdike@...toit.com>
Cc:	Andrew Morton <akpm@...l.org>, linux-kernel@...r.kernel.org,
	user-mode-linux-devel@...ts.sourceforge.net
Subject: Re: [uml-devel] [PATCH 04/10] uml: make execvp safe for our usage

On Wednesday 18 October 2006 20:37, Jeff Dike wrote:
> On Tue, Oct 17, 2006 at 11:27:11PM +0200, Paolo 'Blaisorblade' Giarrusso 
wrote:
> > Reimplement execvp for our purposes - after we call fork() it is
> > fundamentally unsafe to use the kernel allocator - current is not valid
> > there.
>
> This is horriby ugly.

Detail why. The code of execvp()? Passing in the buffer?
I'm not saying it's the brightest code around here, but it's ok for me.

> Can we instead do something different like 
> check out the paths of helpers at early boot, before the kernel is
> running, save them, and simply execve them later?
I initially thought to design a two-steps API with a "which" operation (where 
memory allocation was used) to call later execvp(); when I saw the glibc 
implementation (it allocates one single fixed-size buffer) I saw it was 
simpler this way.

Additionally, error handling cannot be done properly without trying an exec - 
I think it is also ok to drop this execvp semantic, so that if the first 
binary found in path is marked executable but has the wrong binary format the 
whole thing just does not start.

The current implementation already diverges from glibc - it never calls 
directly the shell passing a script, because IMHO execve() will care for that 
(and testing confirmed this IIRC).

I'd not do that at boot, but just before the fork()+execve() - it is 
conceivable that a given user will install a support binary after booting 
UML.

I must say that I've seen files without the shebang working ok (if having the 
executable bit set) when executed from the shell, and I've had the doubt 
execvp() would handle that.

> At that point, something like running "which foo" would be fine by me.

-- 
Inform me of my mistakes, so I can keep imitating Homer Simpson's "Doh!".
Paolo Giarrusso, aka Blaisorblade
http://www.user-mode-linux.org/~blaisorblade
Chiacchiera con i tuoi amici in tempo reale! 
 http://it.yahoo.com/mail_it/foot/*http://it.messenger.yahoo.com 
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/