linux-kernel - Re: [link@...gy.org: Re: [patch 2/8] personality: fix PER_CLEAR_ON

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Sun, 19 Jul 2009 12:47:25 -0700 (PDT)
From:	Linus Torvalds <torvalds@...ux-foundation.org>
To:	Athanasius <link@...gy.org>
cc:	linux-kernel <linux-kernel@...r.kernel.org>,
	Julien TINNES <jt@....org>, Greg KH <gregkh@...e.de>,
	Tavis Ormandy <taviso@....lonestar.org>,
	Christoph Hellwig <hch@...radead.org>,
	Kees Cook <kees@...ntu.com>, Eugene Teo <eugene@...hat.com>
Subject: Re: [link@...gy.org: Re: [patch 2/8] personality: fix PER_CLEAR_ON_SETID
 (CVE-2009-1895)]

On Sun, 19 Jul 2009, Athanasius wrote:
> 
>   Would you agree that having these features default-off would be best?

I'm actually pretty sure that some glibc versions in particular have 
actively used some of the personality bits.

I have this fairly clear memory of seeing 'personality()' system calls in 
strace output from regular programs.

I just tested it, and I'm not seeing it in my current distro for normal 
programs, but the point is, I'm pretty sure that we have real binaries out 
there that depend on personality bits.

So we can't default-off the whole personality thing. We would have to 
default-off just a subset of the bits. Would that be useful? Perhaps.

			Linus
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/