linux-kernel - Re: [RFC/PATCH] revoke/frevoke system calls V2

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Mon, 7 Aug 2006 22:41:44 +0200
From:	Edgar Toernig <froese@....de>
To:	"Pekka Enberg" <penberg@...helsinki.fi>
Cc:	"Pavel Machek" <pavel@....cz>, linux-kernel@...r.kernel.org,
	linux-fsdevel@...r.kernel.org, akpm@...l.org,
	viro@...iv.linux.org.uk, alan@...rguk.ukuu.org.uk, tytso@....edu,
	tigran@...itas.com
Subject: Re: [RFC/PATCH] revoke/frevoke system calls V2

Pekka Enberg wrote:
>
> On 8/7/06, Edgar Toernig <froese@....de> wrote:
> > Why do we need [f]revoke at all?  As it doesn't implement the
> > BSD semantic I can't see why it's better than fuser -k.
> 
> Which part of the BSD semantics is that?

That which talks about character devices, in particular ttys.

NetBSD revoke(2):
|
| ... a read() from a character device file which has been revoked
| returns a count of zero (end of file), and a close() call will
| succeed.
|...
| revoke is normally used to prepare a terminal device for a new
| login session, preventing any access by a previous user of the
| terminal.

Irix revoke(2) even mentions:
|
| ERRORS:
|  ...
|  [EINVAL] The named file is not a character-special file.

It seems, revoke was intended to disable access to tty devices
from old processes in a controlled way.  Sounds sane.

Your implementation is much cruder - it simply takes the fd
away from the app; any future use gives EBADF.  As a bonus,
it works for regular files and even goes as far as destroying
all mappings of the file from all processes (even root processes).
IMVHO this is a disaster from a security and reliability point
of view.

So, the behaviour regarding ttys is completely different to
other implementations and for other types of fds the Linux
semantic seems unique (the man-pages of the other systems
are pretty silent about that).

A serious question: What do you need this feature of revoking
regular files (or block devices) for?  Maybe my imagination
is lacking, but I can't find a use where fuser(1) (or similar
tools) wouldn't be as good or even better than revoke(2).

Ciao, ET.
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/