linux-kernel - RE: Pull request for FS-Cache, including NFS patches

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <7A24DF798E223B4C9864E8F92E8C93EC01AAFE6E@SACMVEXC1-PRD.hq.netapp.com>
Date:	Tue, 30 Dec 2008 15:00:02 -0800
From:	"Muntz, Daniel" <Dan.Muntz@...app.com>
To:	"Trond Myklebust" <trond.myklebust@....uio.no>
Cc:	"Andrew Morton" <akpm@...ux-foundation.org>,
	"Stephen Rothwell" <sfr@...b.auug.org.au>,
	"Bernd Schubert" <bernd.schubert@...tmail.fm>,
	<nfsv4@...ux-nfs.org>, <linux-kernel@...r.kernel.org>,
	<steved@...hat.com>, <dhowells@...hat.com>,
	<linux-next@...r.kernel.org>, <linux-fsdevel@...r.kernel.org>,
	<rwheeler@...hat.com>
Subject: RE: Pull request for FS-Cache, including NFS patches

Yes, and if you have a single user on the machine at a time (with cache
flushed inbetween, kernel refreshed), root can read /dev/kmem, swap,
intercept traffic and read cachefs data to its heart's content--hence,
those requirements.

  -Dan

-----Original Message-----
From: Trond Myklebust [mailto:trond.myklebust@....uio.no] 
Sent: Tuesday, December 30, 2008 2:36 PM
To: Muntz, Daniel
Cc: Andrew Morton; Stephen Rothwell; Bernd Schubert;
nfsv4@...ux-nfs.org; linux-kernel@...r.kernel.org; steved@...hat.com;
dhowells@...hat.com; linux-next@...r.kernel.org;
linux-fsdevel@...r.kernel.org; rwheeler@...hat.com
Subject: RE: Pull request for FS-Cache, including NFS patches

On Tue, 2008-12-30 at 14:15 -0800, Muntz, Daniel wrote:
> >> As for security, look at what MIT had to do to prevent local disk 
> >> caching from breaking the security guarantees of AFS.
> >
> >See what David has added to the LSM code to provide the same 
> >guarantees
> for cachefs...
> >
> >Trond
> 
> Unless it (at least) leverages TPM, the issues I had in mind can't 
> really be addressed in code.  One requirement is to prevent a local 
> root user from accessing fs information without appropriate
permissions.
> This leads to unwieldly requirements such as allowing only one user on

> a machine at a time, blowing away the cache on logout, validating 
> (e.g.,
> refreshing) the kernel on each boot, etc.  Sure, some applications 
> won't care, but you're also potentially opening holes that users may 
> not consider.

You can't prevent a local root user from accessing cached data: that's
true with or without cachefs. root can typically access the data using
/dev/kmem, swap, intercepting tty traffic, spoofing user creds,...
If root can't be trusted, then find another machine.

The worry is rather that privileged daemons may be tricked into
revealing said data to unprivileged users, or that unprivileged users
may attempt to read data from files to which they have no rights using
the cachefs itself. That is a problem that is addressable by means of
LSM, and is what David has attempted to solve.

  Trond

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/