linux-kernel - Re: [PATCH] usb-storage: don't call utsname()

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20080521193517.GA4905@kroah.com>
Date:	Wed, 21 May 2008 12:35:17 -0700
From:	Greg KH <greg@...ah.com>
To:	Christoph Hellwig <hch@...radead.org>
Cc:	Alan Stern <stern@...land.harvard.edu>,
	Matthew Dharm <mdharm-usb@...-eyed-alien.net>,
	"Frank Ch. Eigler" <fche@...hat.com>,
	Adrian Bunk <bunk@...nel.org>,
	USB Storage list <usb-storage@...ts.one-eyed-alien.net>,
	Kernel development list <linux-kernel@...r.kernel.org>,
	"David S. Miller" <davem@...set.davemloft.net>,
	systemtap@...rces.redhat.com,
	Andrew Morton <akpm@...ux-foundation.org>,
	linux-cifs-client@...ts.samba.org, linux-nfs@...r.kernel.org
Subject: Re: [PATCH] usb-storage: don't call utsname()

On Wed, May 21, 2008 at 02:52:51PM -0400, Christoph Hellwig wrote:
> On Wed, May 21, 2008 at 11:09:57AM -0700, Greg KH wrote:
> > Why?  With this change, if you change the version number, the file will
> > have to be rebuilt.  Without the change, the file will not need to be
> > rebuilt, right?
> 
> Because thanks to the container patches it utsname fields other than
> hostname can actually change at runtime now and you'll get races looking
> at them.  And probably not the output you want if someone in your
> container changes the kernel version to trick applications.

So, do we now go and rip out all usages of utsname()->release and put
back the #define just because of the loonacy of containers?

No kernel should have to change it's version number to trick an
application, why would an application care about the version number to
start with?  In the "enterprise kernel" world, version numbers have
little to no relevance on the functionality or features of the kernel,
so any check of something like this is sure to be wrong to start with.

thanks,

greg k-h
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/