linux-kernel - Re: [PATCH 1/2] VM/SELinux: require CAP_SYS_RAWIO for all mmap

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20090721173019.2ac83140@lxorguk.ukuu.org.uk>
Date:	Tue, 21 Jul 2009 17:30:19 +0100
From:	Alan Cox <alan@...rguk.ukuu.org.uk>
To:	Eric Paris <eparis@...hat.com>
Cc:	linux-kernel@...r.kernel.org, selinux@...ho.nsa.gov,
	linux-security-module@...r.kernel.org, sds@...ho.nsa.gov,
	jmorris@...ei.org, spender@...ecurity.net, dwalsh@...hat.com,
	cl@...ux-foundation.org, arjan@...radead.org, kyle@...artin.ca,
	cpardy@...hat.com, arnd@...db.de
Subject: Re: [PATCH 1/2] VM/SELinux: require CAP_SYS_RAWIO for all mmap_zero
 operations

On Tue, 21 Jul 2009 12:23:14 -0400
Eric Paris <eparis@...hat.com> wrote:

> On Tue, 2009-07-21 at 17:09 +0100, Alan Cox wrote:
> 
> > It's a really ugly problem that almost begs for better hardware
> > facilities (such as the multiple independent address spaces in some
> > processors)
> 
> If only we knew someone who worked at intel.....   *smile*
> 
> Are you on board with the change I propose as long as I make the address
> space controlled by SELinux tunable instead of fixed at one page?  Thus
> allowing one to maintain the status quo?  Yeah, still sucks for
> non-selinux systems and wine, but at least there can be hardening
> against a non-root local authenticated user on a default fedora
> install...

I don't like it much, but I have exactly zero better ideas. It's also
your area of expertise not mine, so I'm not going to object further.

Alan
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/