linux-kernel - Re: [patch 2/2] ufd v1 - use unsequential O(1) fdmap

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Sun, 3 Jun 2007 13:19:39 -0700 (PDT)
From:	Davide Libenzi <davidel@...ilserver.org>
To:	Ulrich Drepper <drepper@...hat.com>
cc:	Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
	Linus Torvalds <torvalds@...ux-foundation.org>,
	Andrew Morton <akpm@...ux-foundation.org>,
	Ingo Molnar <mingo@...e.hu>
Subject: Re: [patch 2/2] ufd v1 - use unsequential O(1) fdmap

On Sun, 3 Jun 2007, Ulrich Drepper wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> Davide Libenzi wrote:
> >> I agree with Ingo, no need for a second magic value.  Use the same value
> >>  as FD_UNSEQ_ALLOC which will just mean this exact value should never be
> >> used as a file descriptor.
> > 
> > I explained this in my answer to Ingo...
> 
> And if we have a new syscall we don't need any of that special dup2
> behavior you describe.  I really don't think this should be added.  dup2
> should just do what POSIX specifies, nothing more.  I would even suggest
> to not allow to dup2() to a descriptor > RLIMIT_NOFILE unless it is
> already allocated.  I.e., don't allow creating arbitrary high descriptors.
> 
> This behavior is completely consistent with the current implementation.
>  No bad surprises.  In fact, it eliminates parts of the ABI
> incompatibility I talked about.

Agreed, a new syscall looks less messy. I'll make sys_dup2() to allow 
installing in the non-sequential area, only if there's an fd already 
allocated. F_DUPFD will remain unchanged (that is, not allow 
non-sequential fds allocations).



> > Random can be expensive. At the moment is FIFO. I'm missing though how 
> > this can be a security flaw, when the legacy one is exactly predictable.
> 
> It's not an added security issue.  It would mean removing a possible
> security the current file descriptor allocation has.
> 
> If randomizing each allocator is too expensive then randomize at the
> very least the number of the first descriptor you give out.

Can you tell me how this can be a problem, and in which way making a 
random thing would help?



- Davide

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/