linux-kernel - Re: [PATCH] Check files' signatures before doing suid/sgid [2/4]

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <1182446983.2704.4.camel@laptopd505.fenrus.org>
Date:	Thu, 21 Jun 2007 10:29:43 -0700
From:	Arjan van de Ven <arjan@...radead.org>
To:	Alexander Wuerstlein <snalwuer@....informatik.uni-erlangen.de>
Cc:	Alexander Wuerstlein <arw@....name>, linux-kernel@...r.kernel.org,
	Johannes Schlumberger <spjsschl@...d.informatik.uni-erlangen.de>
Subject: Re: [PATCH] Check files' signatures before doing suid/sgid [2/4]

On Thu, 2007-06-21 at 19:25 +0200, Alexander Wuerstlein wrote:
> On 070621 19:21, Arjan van de Ven <arjan@...radead.org> wrote:
> > On Thu, 2007-06-21 at 18:02 +0200, Alexander Wuerstlein wrote:
> > > Modified task_struct to hold a 'signed flag' which is set on exec(), inherited
> > > on fork() and checked during exec before giving the new process suid/sgid
> > > privileges.
> > > 
> > 
> > 
> > 
> > do you also check the signature of glibc and every other shared library
> > that the app uses (or dlopens)? if not.. the entire exercise is rather
> > pointless...
> 
> We do check that, that is patch [3/4].
> 
> Of course we can only check mmap-ed files, if there is no file like with JIT
> compilers we are out of luck.

or if the process uses read() not mmap().

or .. or ...


so if perl is signed and it's the perl script that is setuid, and then
it includes other perl libs... that's read() not mmap().

-- 
if you want to mail me at work (you don't), use arjan (at) linux.intel.com
Test the interaction between Linux and your BIOS via http://www.linuxfirmwarekit.org

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/