bugtraq - Re: /proc filesystem allows bypassing directory permissions on Linux

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <19174.6499.411222.991477@cerise.gclements.plus.com>
Date: Mon, 26 Oct 2009 21:49:23 +0000
From: Glynn Clements <glynn@...ements.plus.com>
To: Pavel Machek <pavel@....cz>
Cc: Dan Yefimov <dan@...htwave.net.ru>, bugtraq@...urityfocus.com
Subject: Re: /proc filesystem allows bypassing directory permissions on
 Linux

Pavel Machek wrote:

> Check it again.  There's no race; I check link count before chmod 666.

Which creates a race condition, as the link could be created after the
check but before the chmod.

You can't safely rely upon directory permissions if the directory was
created 0777 then chmod'ed down later. It needs to be created with the
restrictive permissions from the outset.

-- 
Glynn Clements <glynn@...ements.plus.com>