linux-kernel - Re: [PATCH] sysctl: Deprecate sys_sysctl in a user space visible fashion.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 30 Aug 2007 08:13:05 -0400
From:	Theodore Tso <tytso@....edu>
To:	"Eric W. Biederman" <ebiederm@...ssion.com>
Cc:	"H. Peter Anvin" <hpa@...or.com>,
	Alan Cox <alan@...rguk.ukuu.org.uk>,
	Christoph Hellwig <hch@...radead.org>,
	Andrew Morton <akpm@...ux-foundation.org>,
	linux-kernel@...r.kernel.org
Subject: Re: [PATCH] sysctl: Deprecate sys_sysctl in a user space visible fashion.

On Wed, Aug 29, 2007 at 01:00:07PM -0600, Eric W. Biederman wrote:
> "H. Peter Anvin" <hpa@...or.com> writes:
> 
> > Eric W. Biederman wrote:
> >>
> >> My hypothesis.  No one cares now.
> >>
> >> My observation. The way we have been maintaining the binary sysctl
> >> side of things using it is asking for your application to be broken in
> >> subtle and nasty ways.
> >>
> >
> > I suspect the right thing to do is simply to make a list of the supported binary
> > sysctls, and automatically verify those numbers.  Doing that would alleviate
> > these concerns, wouldn't break anything, and isn't really that hard to do.
> 
> Well the list is currently 1200 lines long, with wild cards in it.
> See sysctl_check.c in the -mm tree.  I think I have finally found
> all of the binary sysctl numbers that are currently in use but I may
> have missed something.  Although that can probably be trimmed a bit
> now that a number of those sysctls have been identified as impossibly
> and always broken

It's not hard to do read-side, right?  Take the list of sysctl's, and
create a program which reads it via the binary interface and the /proc
interface, and verify they are the same.  

Testing write-side, where we have to worry about permission tests,
making sure the correctr value is set, locking issues, etc., is
admittedly more difficult.  My guess though many programs/libraries
are reading from the sysctl interface than writing to it.

    	    	     	    	      	   - Ted
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/