linux-kernel - Re: fanotify: the fscking all notification system

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 07 Jul 2009 16:57:11 -0400
From:	Eric Paris <eparis@...hat.com>
To:	Valdis.Kletnieks@...edu
Cc:	linux-kernel@...r.kernel.org, malware-list@...sg.printk.net
Subject: Re: fanotify: the fscking all notification system

On Tue, 2009-07-07 at 15:41 -0400, Valdis.Kletnieks@...edu wrote:
> On Tue, 30 Jun 2009 13:26:37 EDT, Eric Paris said:

> > 1) the fd the fanotify listener gets is O_RDONLY.  I think I'll add an
> > "f_flags" option which if 0 defaults to O_RDONLY|O_LARGEFILE like we
> > have today but which you could use to indicate O_RDWR or O_WRONLY.  We
> > currently give O_RDONLY since you can't request O_WR* on files/libraries
> > mapped exec, so this won't work for executables.....
> 
> Having only O_RDONLY is a show-stopper, because then we can't replace the file
> contents before continuing.  For many places, the executables and shared
> libraries aren't the problem, so "You can't HSM an executable" as a
> semi-permanent restriction isn't too bad.

My current devel work allows you to set to open flags.  So an HSM would
use O_RDWR|O_LARGEFILE whereas a file scanner/indexer which cares about
executables/libraries would use O_RDONLY|O_LARGEFILE.

> > 2) Right now you have 5 seconds to answer an fanotify permissions
> > request, if you don't get it in 5 seconds you are done and the original
> > process gets an allow.  But I have a half finished patch which would
> > allow you to delay them infinitely.  As long as you keep them delayed
> > you can modify the file they are about to access however you like.
> 
> That would work fine.

I've added the ability to delay indefinitely.  Maybe your tape
robot/intern is slow/busy.  I'll point you to code when I want you to
see it   :)

> Yes, it's sounding like it. If that's in mainstream, then I can deploy an HSM
> without needing kernel hackery like most do currently.

I'm trying to be useful!

-Eric

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/