| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20091026163157.GB7233@duck.suse.cz> Date: Mon, 26 Oct 2009 17:31:57 +0100 From: Jan Kara <jack@...e.cz> To: Pavel Machek <pavel@....cz> Cc: kernel list <linux-kernel@...r.kernel.org>, linux-fsdevel@...r.kernel.org, viro@...iv.linux.org.uk, jamie@...reable.org Subject: Re: symlinks with permissions Hi, On Sun 25-10-09 07:29:53, Pavel Machek wrote: > ...yes, they do exist, in /proc/self/fd/* . Unfortunately, their > permissions are not actually checked during open, resulting in > (obscure) security hole: if you have fd open for reading, you can > reopen it for write, even through unix permissions would not allow > that. > > Now... I'd like to close the hole. One way would be to actually check > symlink permissions on open -- because those symlinks already have > correct permissions. Hmm, I'm not sure I understand the problem. Symlink is just a file containing a path. So if you try to open a symlink, you will actually open a file to which the path points. So what security problem is here? Either you can open the file symlink points to for writing or you cannot... Anyway, if you want to play with this, fs/proc/base.c:proc_pid_follow_link is probably the function you are interested in. Honza -- Jan Kara <jack@...e.cz> SUSE Labs, CR -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists