linux-kernel - Re: [PATCH v2 9/9] test_sysctl: test against int proc

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 17 May 2017 00:40:32 +0200
From:   "Luis R. Rodriguez" <mcgrof@...nel.org>
To:     Kees Cook <keescook@...omium.org>
Cc:     "Luis R. Rodriguez" <mcgrof@...nel.org>,
        Al Viro <viro@...iv.linux.org.uk>,
        Andrew Morton <akpm@...ux-foundation.org>,
        "Eric W. Biederman" <ebiederm@...ssion.com>,
        Arnaldo Carvalho de Melo <acme@...hat.com>,
        Ingo Molnar <mingo@...nel.org>, Mel Gorman <mgorman@...e.de>,
        Subash Abhinov Kasiviswanathan <subashab@...eaurora.org>,
        Jessica Yu <jeyu@...hat.com>,
        Rusty Russell <rusty@...tcorp.com.au>,
        Steven Whitehouse <swhiteho@...hat.com>,
        Deepa Dinamani <deepa.kernel@...il.com>,
        Matt Fleming <matt@...eblueprint.co.uk>,
        Alexey Dobriyan <adobriyan@...il.com>,
        Borislav Petkov <bp@...e.de>,
        Dmitry Torokhov <dmitry.torokhov@...il.com>, shuah@...nel.org,
        Linus Torvalds <torvalds@...ux-foundation.org>,
        Guenter Roeck <linux@...ck-us.net>,
        linux-kselftest@...r.kernel.org,
        LKML <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH v2 9/9] test_sysctl: test against int proc_dointvec()
 array support

On Mon, Feb 13, 2017 at 02:07:53PM -0800, Kees Cook wrote:
> On Fri, Feb 10, 2017 at 4:36 PM, Luis R. Rodriguez <mcgrof@...nel.org> wrote:
> > diff --git a/tools/testing/selftests/sysctl/sysctl.sh b/tools/testing/selftests/sysctl/sysctl.sh
> > index eedfba6f0a57..963d572155b1 100755
> > --- a/tools/testing/selftests/sysctl/sysctl.sh
> > +++ b/tools/testing/selftests/sysctl/sysctl.sh
> > @@ -137,6 +142,12 @@ verify()
> >         return 0
> >  }
> >
> > +verify_diff_w()
> > +{
> > +       echo "$TEST_STR" | diff -w -u - $1 2>&1 > /dev/null
> 
> Instead of shell redirection, just use -q ?

Will try.

> I love seeing these tests added. I have one other change I'd like to
> add to sysctl,

Upon a glance again at this stuff I can think of a few other checks
but one battle at a time...

> but I haven't had time to make sure it doesn't break
> stuff. I haven't been able to prove it to myself, but I think it's
> safe; I just need to update the tests to handle it:
> 
> http://git.kernel.org/cgit/linux/kernel/git/kees/linux.git/commit/?h=sysctl/writes_strict&id=b63a38ca45bd9fb61545ce6ce66093147eb96a7c
> 
> It'd need an update for the uint handler...

That would also expands on the definition of the strict mode. I think this is
fair if we take it for granted strict will always aim for correctness, but we
also have to be fair and be clear on possible impact and ensure nothing will
bust. I have a feeling though that we'd keep on going with these semantics on
and on and on... which really is just irritating and it tells me something more
wrong about this crap interface.

Just a rant here...

  Luis