linux-kernel - Re: [RFC][PATCH] security: split ptrace checking in proc

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20080514152817.GC17453@sequoia.sous-sol.org>
Date:	Wed, 14 May 2008 08:28:17 -0700
From:	Chris Wright <chrisw@...s-sol.org>
To:	Stephen Smalley <sds@...ho.nsa.gov>
Cc:	Chris Wright <chrisw@...s-sol.org>, casey@...aufler-ca.com,
	lsm <linux-security-module@...r.kernel.org>,
	James Morris <jmorris@...ei.org>,
	Eric Paris <eparis@...isplace.org>,
	lkml <linux-kernel@...r.kernel.org>
Subject: Re: [RFC][PATCH] security:  split ptrace checking in proc

* Stephen Smalley (sds@...ho.nsa.gov) wrote:
> On Wed, 2008-05-14 at 02:15 -0700, Chris Wright wrote:
> > It is slightly ad-hoc.  Is it just the audit messages that you described
> > that made you pick environ and fd, or was there more specific (threat
> > based) reasoning?  Would /proc/pid/fd/ + genfs + e.g. anonfd be a little
> > wider than just readstate?
> 
> Well, it is being driven by experience with what applications try to
> access w/o requiring full ptrace access, but also by a threat-based
> reasoning that it is less dangerous to grant limited read access to
> parts of the process state than to grant complete read access to its
> entire memory image or full control of the target process.
> 
> Not entirely sure what you mean by the latter question.

fd/ access gives a view in the ->files, which could include rather
internal bits like pipes, sockets, or anonfd descriptors -- things w/out
external handles.  That view includes ability to open the fd (similar
to dup()) and use it (granted subject to further security checks, but
they may be quite generic at that point).

thanks,
-chris
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/