linux-kernel - Re: Re: [PATCH] usb-storage: don't call utsname()

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <48348D9B.8090707@us.ibm.com>
Date:	Wed, 21 May 2008 16:01:15 -0500
From:	"Steve French (smfltc)" <smfltc@...ibm.com>
To:	Greg KH <greg@...ah.com>
CC:	Christoph Hellwig <hch@...radead.org>,
	Alan Stern <stern@...land.harvard.edu>,
	Matthew Dharm <mdharm-usb@...-eyed-alien.net>,
	"Frank Ch. Eigler" <fche@...hat.com>,
	Adrian Bunk <bunk@...nel.org>,
	USB Storage list <usb-storage@...ts.one-eyed-alien.net>,
	Kernel development list <linux-kernel@...r.kernel.org>,
	"David S. Miller" <davem@...set.davemloft.net>,
	systemtap@...rces.redhat.com,
	Andrew Morton <akpm@...ux-foundation.org>,
	linux-cifs-client@...ts.samba.org, linux-nfs@...r.kernel.org
Subject: Re: Re: [PATCH] usb-storage: don't call utsname()

Greg KH wrote:
> On Wed, May 21, 2008 at 02:52:51PM -0400, Christoph Hellwig wrote:
>   
>> On Wed, May 21, 2008 at 11:09:57AM -0700, Greg KH wrote:
>>     
>>> Why?  With this change, if you change the version number, the file will
>>> have to be rebuilt.  Without the change, the file will not need to be
>>> rebuilt, right?
>>>       
>> Because thanks to the container patches it utsname fields other than
>> hostname can actually change at runtime now and you'll get races looking
>> at them.  And probably not the output you want if someone in your
>> container changes the kernel version to trick applications.
>>     
>
> So, do we now go and rip out all usages of utsname()->release and put
> back the #define just because of the loonacy of containers?
>
> No kernel should have to change it's version number to trick an
> application, why would an application care about the version number to
>   
The version number (of the OS not just of the SMB/CIFS implementation, 
both of which are exchanged by client and server) has sometimes been 
useful in debugging problems that I and others and the Samba team look 
at (you can see it in wireshark/tcpdump traces, and it can be logged 
easily on either end as well).

If containers are crazy enough to change the version number, not just 
the hostname, why don't we simply define a three line macro for 
retrieving this which is safe and put it in utsname.h?
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/