linux-kernel - Re: O_NOLINK for open()

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20070912224955.GC8181@ftp.linux.org.uk>
Date:	Wed, 12 Sep 2007 23:49:55 +0100
From:	Al Viro <viro@....linux.org.uk>
To:	Brent Casavant <bcasavan@....com>
Cc:	Andreas Schwab <schwab@...e.de>, linux-kernel@...r.kernel.org
Subject: Re: O_NOLINK for open()

On Wed, Sep 12, 2007 at 05:44:30PM -0500, Brent Casavant wrote:

> P.S. By the way, there doesn't seem to be a way to remove /proc/#/mem
>      files.  That might be an additional nicety -- programs worried about
>      being snooped could unlink their own entry.  /dev/mem and /dev/kmem
>      can simply be removed by the sysadmin of such a system.  If all of
>      that were done you'd have to resort to attacking crash dumps, core
>      dumps, or via something like kdb to extract "hidden" data.

Give me a break.  And learn about ptrace(2).  This "unlinking" bullshit
buys you zero additional security, both for /proc/*/mem and for /dev/mem
(see mknod(2)).
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/