linux-kernel - Re: [PATCH] Added PR_SET_PROCTITLE

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Sun, 4 Oct 2009 21:44:13 -0400
From:	Bryan Donlan <bdonlan@...il.com>
To:	KOSAKI Motohiro <kosaki.motohiro@...fujitsu.com>
Cc:	KOSAKI Motohiro <kosaki.motohiro@...il.com>,
	Timo Sirainen <tss@....fi>, linux-kernel@...r.kernel.org,
	Ulrich Drepper <drepper@...hat.com>
Subject: Re: [PATCH] Added PR_SET_PROCTITLE_AREA option for prctl()

On Sun, Oct 4, 2009 at 9:38 PM, KOSAKI Motohiro
<kosaki.motohiro@...fujitsu.com> wrote:
>> The improvement idea is here.
>>
>> Changelog
>>   - Added task_lock() to prctl(PR_SET_PROCTITLE_AREA)
>>  -  Added small input sanity check to prctl(PR_SET_PROCTITLE_AREA)
>
> Doh, task_lock() is obviously wrong. please forget this.

As another note, in general I think we'd need to hold a lock over the
entire operation. After all, if userspace changes its PROCTITLE_AREA,
and then reuses the memory for something else, we have an information
leak.

Perhaps a simpler approach would simply be to add a generation
counter. Read it once at the start, barrier, then grab the title. Then
at the end, read the generation counter again. If the value changed,
we need to start over. Also, in this case, an error when reading the
target process' memory should be ignored and retried, as we may have
hit a race in which the target process unmapped the proctitle area
after changing it.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/