linux-kernel - Re: [PATCH stable 3/4] block: fail SCSI passthrough ioctls on partition devices

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 18 Jan 2012 10:00:57 +0100
From:	Paolo Bonzini <pbonzini@...hat.com>
To:	Ben Hutchings <ben@...adent.org.uk>
CC:	stable@...r.kernel.org,
	Linus Torvalds <torvalds@...ux-foundation.org>,
	linux-kernel@...r.kernel.org, Petr Matousek <pmatouse@...hat.com>,
	linux-scsi@...r.kernel.org, Jens Axboe <axboe@...nel.dk>,
	James Bottomley <JBottomley@...allels.com>
Subject: Re: [PATCH stable 3/4] block: fail SCSI passthrough ioctls on partition
 devices

On 01/18/2012 05:47 AM, Ben Hutchings wrote:
> >     Changes with respect to 3.3: return -ENOTTY from scsi_verify_blk_ioctl
> >     and -ENOIOCTLCMD from sd_compat_ioctl. ]
>
> But in 2.6.32, compat_sys_ioctl will end up returning EINVAL rather than
> ENOTTY for an unhandled ioctl number.

No, it won't.  The ioctl will percolate up the non-compat path and then 
sd_ioctl will return ENOTTY.

> Also, since we're denying ioctls
> for security reasons rather than because we don't know how to handle
> them, I don't think there's any harm in doing this.

There is harm.  You'll be blacklisting also the standard block device 
ioctls, and those won't work on 32-on-64 anymore.  A system with 32-bit 
userland will likely not boot anymore.  This is also somewhat exchanged 
in my original exchange with Linus.

Paolo
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/