linux-kernel - Re: [PATCH] vfs: new O

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 30 Sep 2009 08:18:21 +0000
From:	Florian Weimer <fweimer@....de>
To:	Jamie Lokier <jamie@...reable.org>
Cc:	Miklos Szeredi <miklos@...redi.hu>, Valdis.Kletnieks@...edu,
	linux@...blig.org, agruen@...e.de, linux-fsdevel@...r.kernel.org,
	linux-kernel@...r.kernel.org
Subject: Re: [PATCH] vfs: new O_NODE open flag

* Jamie Lokier:

> I hope the above cannot convert O_NOACCESS to O_RDWR without checking
> that you have access to the file.

It doesn't.

Here's what I did to reproduce:

$ mkdir /tmp/xyz
$ touch /tmp/xyz/123
$ tail -f /tmp/xyz/123

And in another terminal:

$ chmod 000 /tmp/xyz
$ echo foo > /tmp/xyz/123
bash: /tmp/xyz/123: Permission denied
$ $ echo foo > /proc/$pid_of_tail/fd/5

And the first terminal prints "foo".  It fails if the file it self is
not writeable, only the access check on the path is bypassed.  I still
think this is wrong.

FWIW, fcntl(F_SETFL) is documented to ignore O_RDWR etc. flags.  For
/proc/PID/fd, it probably makes sense to check the current access
flags on the object, and the original open mode.  Rechecking the path
seems impossible because it has unclear semantics.

The whole thing is a bit worrisome because it may turn file descriptor
information leaks into something worse.

-- 
Florian Weimer                <fweimer@....de>
BFK edv-consulting GmbH       http://www.bfk.de/
Kriegsstraße 100              tel: +49-721-96201-1
D-76133 Karlsruhe             fax: +49-721-96201-99
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/