linux-kernel - Re: [PATCH 1/2] VM/SELinux: require CAP_SYS_RAWIO for all mmap

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20090721163813.0cb5d7ab@lxorguk.ukuu.org.uk>
Date:	Tue, 21 Jul 2009 16:38:13 +0100
From:	Alan Cox <alan@...rguk.ukuu.org.uk>
To:	Eric Paris <eparis@...hat.com>
Cc:	linux-kernel@...r.kernel.org, selinux@...ho.nsa.gov,
	linux-security-module@...r.kernel.org, sds@...ho.nsa.gov,
	jmorris@...ei.org, spender@...ecurity.net, dwalsh@...hat.com,
	cl@...ux-foundation.org, arjan@...radead.org, kyle@...artin.ca,
	cpardy@...hat.com, arnd@...db.de
Subject: Re: [PATCH 1/2] VM/SELinux: require CAP_SYS_RAWIO for all mmap_zero
 operations

> turns it off for the whole system when you install WINE.  This patch
> doesn't change that fact.  All it does is add that requirement to
> SELinux systems that already exists on non-selinux systems.

Prior to this an SELinux system could implement sensible security. The
fact Fedora didn't was paranoia and fear over a bad experience made what
five years ago ?

> > Am I missing something here, this "solution" sounds completely brain
> > dead ?
> 
> Well, with patch 2/2 you still get your SELinux protections (only for 1
> page) even if you disable it for the whole system.  So in the end, you
> have better protection than you have today with this series....

We know one page isn't sufficient. That has been seen from some exploit
cases.

So this looks to me like a regression in features, that makes the system
less secure and doesn't solve anything at all.

Whereas if you just set the default SELinux user confinement to allow
everything but mapping low pages you wouldn't actually need to mess up
the kernel ?

Currently I have low page protection and I don't have to run wine as
CAP_SYS_RAWIO (which comes in the "sucidial ideas") category. I consider
the loss of that ability a regression.

Alan
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/