linux-kernel - Re: [PATCH v2 resend] vfs: new O

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <m17hu3xtiy.fsf@fess.ebiederm.org>
Date:	Fri, 06 Nov 2009 12:55:33 -0800
From:	ebiederm@...ssion.com (Eric W. Biederman)
To:	Pavel Machek <pavel@....cz>
Cc:	Miklos Szeredi <miklos@...redi.hu>,
	Alan Cox <alan@...rguk.ukuu.org.uk>, akpm@...ux-foundation.org,
	viro@...IV.linux.org.uk, dhowells@...hat.com, hch@...radead.org,
	adilger@....com, mtk.manpages@...il.com,
	torvalds@...ux-foundation.org, drepper@...il.com,
	jamie@...reable.org, linux-fsdevel@...r.kernel.org,
	linux-kernel@...r.kernel.org
Subject: Re: [PATCH v2 resend] vfs: new O_NODE open flag

Pavel Machek <pavel@....cz> writes:

> On Thu 2009-11-05 15:27:06, Miklos Szeredi wrote:
>> On Thu, 5 Nov 2009, Alan Cox wrote:
>> > >  - re-opening normally after checking file type (there's a debate
>> > >    whether this would have security issues, but currently we do allow
>> > >    re-opening with increased permissions thorugh /proc/*/fd)
>> > 
>> > Which has already been demonstrated to be an (unfixed) security hole.
>> 
>> No it hasn't :)  Jamie theorized that there *might* be a real world
>> situation where the application writer didn't anticipate this
>> behavior.  But as to actual demonstration, we have not seen one yet, I
>> think.
>
> See bugtraq, or lkml thread about symlinks with permissions. There's
> demo script there.

Exactly a theoretical discussion, that demonstrates user space
applications with security holes can be written if they make
assumptions about the world that are not true.

So far no one who believes this to be a security hole has found it
worth their while to look at nd->intent.open in proc_pid_follow_link
and write a patch.    Pavel you started out asking for help on how
to do that and I think I have answered the original question.

I am tired of the whining.  If no one who is persuaded the kernel is
wrong can be bothered to write a possibly buggy 5 line patch this is
clearly not a security hole.

Eric
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/