linux-kernel - Re: [patch 1/3] MAP_NOZERO - implement a new VM_NOZERO/MAP

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20070628061911.GA16986@hexapodia.org>
Date:	Wed, 27 Jun 2007 23:19:11 -0700
From:	Andy Isaacson <adi@...apodia.org>
To:	Davide Libenzi <davidel@...ilserver.org>
Cc:	Rik van Riel <riel@...hat.com>,
	Linux Kernel Mailing List <linux-kernel@...r.kernel.org>
Subject: Re: [patch 1/3] MAP_NOZERO - implement a new VM_NOZERO/MAP_NOZERO page retirement policy

On Tue, Jun 26, 2007 at 09:32:44PM -0700, Davide Libenzi wrote:
> > Because an SUID program can change its UID back.
> > 
> > At least, one that was SUID root.  OTOH, any
> > program running as root can change UID, so we
> > should probably not allow root to get nonzeroed
> > pages.
> 
> Well, root can in general access the whole system in any case. At the 
> moment, root cannot access othe UIDs pages. Only their own. And this 
> differs from standard security policies where root can access everything.
> Pages used internally by the kernel, cannot be reused by anyone.

But MAP_NOZERO adds a new possible information leak from root out to the
non-root user.  If root does

    setuid(newuid);
    exec(...);
    exit(1);

and there are MAP_NOZERO pages which contain sensitive information,
a process running as newuid would be able to race the exec with
PTRACE_ATTACH and extract the sensitive information.  Without MAP_NOZERO
the information leak is limited to information which was in the setuid
program's address space (and presumably, setuid programs are written to
be careful about such things).

That said, I think I like the idea of MAP_NOZERO.  Could it be
generalized to some kind of "free pool" rather than keyed off of uid?

-andy
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/