linux-kernel - Re: [RFC/PATCH] revoke/frevoke system calls V2

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 9 Aug 2006 10:41:59 +0200
From:	Edgar Toernig <froese@....de>
To:	Alan Cox <alan@...rguk.ukuu.org.uk>
Cc:	Chase Venters <chase.venters@...entec.com>,
	Pekka Enberg <penberg@...helsinki.fi>,
	Pavel Machek <pavel@....cz>, linux-kernel@...r.kernel.org,
	linux-fsdevel@...r.kernel.org, akpm@...l.org,
	viro@...iv.linux.org.uk, tytso@....edu, tigran@...itas.com
Subject: Re: [RFC/PATCH] revoke/frevoke system calls V2

Alan Cox wrote:
>
> Ar Llu, 2006-08-07 am 17:24 -0500, ysgrifennodd Chase Venters:
> > implementation is crude. "EBADF" is not something that applications are 
> > taught to expect. Someone correct me if I'm wrong, but I can think of no 
> > situation under which a file descriptor currently gets yanked out from 
> > under your feet -- you should always have to formally abandon it with 
> > close().
> 
> The file descriptor is not pulled from under you, the access to it is.
> This is exactly what occurs today when a tty is hung up.

If I read the code correctly, the behaviour for hung up ttys is completely
different: read returns EOF, write returns EIO, select/poll/epoll return
ready, close works.  As rather boring but totally sane behaviour for an fd.

But after revoke you get EBADF for any operation, even select or close.
The fd becomes nearly indistinguishable from a really closed fd (the only
difference is that the fd-number won't be reused (potentional DoS)).
And IMHO that's insane that a regular user may close fds in someone else's
processes (or munmap some of its memory).  I already see people trying
to exploit bugs in system services:

	for (;;) revoke("index.html");
	for (;;) revoke("some_print_job");
	for (;;) revoke("some_mail");

Ciao, ET.
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/