linux-kernel - Re: [patch 0/4] MAP_NOZERO v2 - VM_NOZERO/MAP

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <B04FEDC9-A315-4374-843E-DD81E52C5772@mac.com>
Date:	Sat, 30 Jun 2007 20:21:52 -0400
From:	Kyle Moffett <mrmacman_g4@....com>
To:	Davide Libenzi <davidel@...ilserver.org>
Cc:	Andy Isaacson <adi@...apodia.org>,
	Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
	Rik van Riel <riel@...hat.com>
Subject: Re: [patch 0/4] MAP_NOZERO v2 - VM_NOZERO/MAP_NOZERO early summer madness

On Jun 30, 2007, at 19:57:18, Davide Libenzi wrote:
> On Sat, 30 Jun 2007, Kyle Moffett wrote:
>> Very simple case:  SELinux is turned on, an s9 (IE: TOP_SECRET)  
>> process calls free(), and an s3 (IE: UNCLASSIFIED) process calls  
>> malloc(), getting the data from the TOP_SECRET process.
>
> Note that you use *s3* and *s9*. Those will be two different  
> context cookies.  SeLinux will have its own way to set the cookie  
> in the mm_struct, to *s3* in one case, and to *s9* in the other  
> case. This will make things so that they'll never see each other  
> pages.

Except s3 and s9 aren't complete cookies.  A complete label might be:  
"system_u:system_r:apache2_t:s3" for an unclassified apache web- 
server process, or "kmoffett_u:secadmin_r:usershell_t:s9" for me  
logged in with a top-secret label in my security-administrator role.   
That's why you'd need to call an LSM hook to get a unique identifier,  
as the LSM would actually need to allocate identifiers for  
equivalence classes.  Secondly, processes may change labels as they  
run, so you couldn't just call it once and cache the result, you  
would need to call it for every freed page (or every re-use of a page).

>>> It is very easy, assuming a simple unsigned long cookie is enough  
>>> for
>>> SeLinux, to fit in the current MAP_NOZERO.   Well, we have to change
>>> something in the current struct page _mapcount reuse, but that  
>>> doable. There
>>> is one line to change, that is the line where the cookie is  
>>> assigned  to the
>>> mm_struct.

I do think a single unsigned long cookie would work, as long as you  
have an LSM hook:

int process_equivalence_class(struct task_struct *task, unsigned long  
*result);

If it returns 0 then you can use the result as a page cookie,  
otherwise you can't reuse pages for this process at all.

Cheers,
Kyle Moffett

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/