lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:	Mon, 18 Aug 2008 17:03:52 -0700 (PDT)
From:	david@...g.hm
To:	Pavel Machek <pavel@...e.cz>
cc:	Arjan van de Ven <arjan@...radead.org>,
	Eric Paris <eparis@...hat.com>, linux-kernel@...r.kernel.org,
	malware-list@...ts.printk.net, andi@...stfloor.org,
	riel@...hat.com, greg@...ah.com, tytso@....edu,
	viro@...IV.linux.org.uk, alan@...rguk.ukuu.org.uk,
	peterz@...radead.org, hch@...radead.org
Subject: Re: TALPA - a threat model?  well sorta.

On Mon, 18 Aug 2008, Pavel Machek wrote:

> Hi!
>
>>> How does it work? Memory can still change after mmap;
>>> scanning at the
>>> mmap time is _NOT_ enough.
>>>
>>> You could do 'when app attempts to dirty memory,
>>> synchronously unmap
>>> it from all apps that have it mapped' and then do sync
>>> scan on
>>> pagefault time; but that sounds impractical.
>>
>> what is the threat you are trying to defend against?
>>
>> for some threats you are right, for others the scan at
>> mmap time is enough.
>
> I don't see any threats when check at mmap time is okay.
>
> As soon as file servers use mmap, this race can bite you even in very
> simple 'make sure Linux fileserver does not pass on windows malwar'
> threat model.

if you check the file at the time you mmap it and don't expect other 
programs to change the file under you while you are reading it, there's 
nothing to worry about.

shared mmap with one program being able to write to it is a expecially 
hard case of the general problem that if someone writes to a file as you 
are serving it, you don't know what goes out, it may be part of the old 
file and part of the new file. it's just easier to see this problem with 
mmap and harder to catch it.

David Lang
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Powered by blists - more mailing lists