linux-kernel - Re: [PATCH] kernel/sysctl.c: If "count" including the terminating byte '\0' the write system call should retrun success.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Tue, 15 Sep 2015 09:11:37 -0500
From:	"Eric W. Biederman" <ebiederm@...ssion.com>
To:	Sean Fu <fxinrong@...il.com>
CC:	Steven Rostedt <rostedt@...dmis.org>,
	Andrew Morton <akpm@...ux-foundation.org>,
	Austin S Hemmelgarn <ahferroin7@...il.com>,
	Andrey Ryabinin <ryabinin.a.a@...il.com>,
	Ulrich Obergfell <uobergfe@...hat.com>,
	Prarit Bhargava <prarit@...hat.com>,
	Eric B Munson <emunson@...mai.com>,
	"Paul E. McKenney" <paulmck@...ux.vnet.ibm.com>,
	Johannes Weiner <hannes@...xchg.org>,
	Thomas Gleixner <tglx@...utronix.de>,
	Don Zickus <dzickus@...hat.com>,
	Heinrich Schuchardt <xypron.glpk@....de>,
	David Rientjes <rientjes@...gle.com>,
	linux-kernel@...r.kernel.org
Subject: Re: [PATCH] kernel/sysctl.c: If "count" including the terminating byte '\0' the write system call should retrun success.



On September 15, 2015 4:30:56 AM CDT, Sean Fu <fxinrong@...il.com> wrote:
>On Mon, Sep 14, 2015 at 12:44 AM, Eric W. Biederman
><ebiederm@...ssion.com> wrote:
>> Sean Fu <fxinrong@...il.com> writes:
>>
>>> On Sat, Sep 12, 2015 at 1:01 AM, Eric W. Biederman
>>> <ebiederm@...ssion.com> wrote:
>>>> Sean Fu <fxinrong@...il.com> writes:
>> '\0' is not and has never been valid in a text file.
>> proc files are a text interface.
>> Expecting '\0' to be accepted is very strange, and apparently there
>is
>> only one program in existence that does.
>>
>> That a trailing '\0' was ever accepted was due to a bug in the code.
>>
>> Accepting '\0' in general in a text interface is a very dangerous and
>> buggy pattern so it must be done very carefully or else other
>> regressions or bugs could be easily introduced.
>Ok,
>Could you please give me more detail about the potential risk from the
>patch?

Regressions.  AKA There may now be programs that depend on writing a  '\0' failing.

>What is the different behavior between the patch and old kernel?
>It seems like entirely same.

Not at all.  And clear explanations have already been given.

Eric

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/