linux-kernel - Re: [patch] honour MNT

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <200610090209.k9929IdP009924@laptop13.inf.utfsm.cl>
Date:	Sun, 08 Oct 2006 22:09:18 -0400
From:	"Horst H. von Brand" <vonbrand@....utfsm.cl>
To:	Stas Sergeev <stsp@...et.ru>
cc:	Arjan van de Ven <arjan@...radead.org>,
	Ulrich Drepper <drepper@...hat.com>,
	Alan Cox <alan@...rguk.ukuu.org.uk>,
	Jakub Jelinek <jakub@...hat.com>,
	Linux kernel <linux-kernel@...r.kernel.org>,
	Hugh Dickins <hugh@...itas.com>,
	Jeremy Fitzhardinge <jeremy@...p.org>
Subject: Re: [patch] honour MNT_NOEXEC for access() 

Stas Sergeev <stsp@...et.ru> wrote:
> Arjan van de Ven wrote:
> >> but ld.so seems to be
> >> the special case - it is a kernel helper after all,
> > in what way is ld.so special in ANY way?

> It is a kernel helper.

Right. But what prevents anybody to have a hacked, non-testing, ld.so lying
around?

>                        Kernel does all the security
> checks before invoking it. However, when invoked
> directly, it have to do these checks itself. So it is
> special in a way that it have to do the security checks
> which otherwise only the kernel should do.

It just can't do them (reliably at least) in general. Call it a Unix/POSIX
design failure...
-- 
Dr. Horst H. von Brand                   User #22616 counter.li.org
Departamento de Informatica                    Fono: +56 32 2654431
Universidad Tecnica Federico Santa Maria             +56 32 2654239
Casilla 110-V, Valparaiso, Chile               Fax:  +56 32 2797513

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/