linux-kernel - Re: linux-next: manual merge of the userns tree with the vfs tree

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Mon, 06 Aug 2018 12:35:20 -0500
From:   ebiederm@...ssion.com (Eric W. Biederman)
To:     Stephen Rothwell <sfr@...b.auug.org.au>
Cc:     Al Viro <viro@...IV.linux.org.uk>,
        Linux-Next Mailing List <linux-next@...r.kernel.org>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>
Subject: Re: linux-next: manual merge of the userns tree with the vfs tree

Stephen Rothwell <sfr@...b.auug.org.au> writes:

> Hi all,
>
> On Wed, 20 Jun 2018 12:39:05 +1000 Stephen Rothwell <sfr@...b.auug.org.au> wrote:
>
> Are there any comments on this resolution.  I just had to do it all
> again due to slight changes in the vfs tree.  What are you guys going
> to tell Linus when he comes to merge this?

Currently that the fscontext changes have a gaping security hole in it's
userspace API.  Granted the security hole is copied from the existing
mount api.  But I have had multiple real world problems with the
existing behavior, and I have reported it to David Howells multiple
times.

So I honestly don't think David Howells changes are ready to be merged.

The changes to proc exhibit the security holet and I expect they will
have to be redone to make the patch functional.

Eric