linux-kernel - Re: [PATCH v2] efivarfs: Limit the rate for non-root to read files

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Fri, 23 Feb 2018 20:34:15 +0000
From:   Andy Lutomirski <luto@...nel.org>
To:     Ard Biesheuvel <ard.biesheuvel@...aro.org>
Cc:     Linus Torvalds <torvalds@...ux-foundation.org>,
        "Luck, Tony" <tony.luck@...el.com>,
        Andi Kleen <ak@...ux.intel.com>,
        Joe Konno <joe.konno@...ux.intel.com>,
        "linux-efi@...r.kernel.org" <linux-efi@...r.kernel.org>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
        Jeremy Kerr <jk@...abs.org>,
        Matthew Garrett <mjg59@...gle.com>,
        Peter Jones <pjones@...hat.com>,
        Andy Lutomirski <luto@...nel.org>,
        James Bottomley <james.bottomley@...senpartnership.com>
Subject: Re: [PATCH v2] efivarfs: Limit the rate for non-root to read files

On Thu, Feb 22, 2018 at 6:08 PM, Ard Biesheuvel
<ard.biesheuvel@...aro.org> wrote:
> On 22 February 2018 at 18:07, Linus Torvalds
> <torvalds@...ux-foundation.org> wrote:
>> On Thu, Feb 22, 2018 at 9:54 AM, Luck, Tony <tony.luck@...el.com> wrote:
>>> With the new "while/nap" change there would still be one message
>>> per second, but the number of callbacks suppressed should be 1
>>> (unless the user has many threads doing reads).
>>>
>>> Maybe it is good to know that an application is doing something
>>> stupid and we should drop that line from the patch and let the
>>> warnings flow?
>>
>> I think the "one message per second" is fine.
>>
>> Looks good. Do I get this through the EFI tree, or should I just take
>> it directly?
>>
>
> Please take it directly if everybody is happy with it.
>
> Acked-by: Ard Biesheuvel <ard.biesheuvel@...aro.org>

I don't like this at all.  We're coming up with a bizarre ad-hoc hack
to work around the fact that we're allowing any unprivileged user can
call into firmware.  Let's just require privilege.  As I understand
it, Windows already requires privilege, and Windows is *right*.

Let's apply the original patch, not my patch.  Then, if it causes
problems with sealtotp, either users can chmod the relevant file or we
can add a gross hack in the kernel to make that particular file 0644
*and print a warning* if the file exists.  Then users can bug mjg to
fix sealtotp to use a privileged helper or systemd service or whatever
and rename the file at the same time.

But I read the sealtotp manual, and I don't see the point of using an
EFI var for sealtotp in the first place.  sealtotp supports TPM NV
storage, EFI vars, and plain old files.  I get why TPM NV makes
logical sense (sealtotp is a TPM thing), and using a plain old file
seems entirely reasonable.  I don't see why anyone would prefer an EFI
variable.

--Andy