linux-kernel - Re: [PATCH v2 resend] vfs: new O

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <E1NA06k-0007zE-91@pomaz-ex.szeredi.hu>
Date:	Mon, 16 Nov 2009 12:50:58 +0100
From:	Miklos Szeredi <miklos@...redi.hu>
To:	Pavel Machek <pavel@....cz>
CC:	ebiederm@...ssion.com, miklos@...redi.hu, alan@...rguk.ukuu.org.uk,
	akpm@...ux-foundation.org, viro@...IV.linux.org.uk,
	dhowells@...hat.com, hch@...radead.org, adilger@....com,
	mtk.manpages@...il.com, torvalds@...ux-foundation.org,
	drepper@...il.com, jamie@...reable.org,
	linux-fsdevel@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH v2 resend] vfs: new O_NODE open flag

On Sun, 8 Nov 2009, Pavel Machek wrote:
> Does it really close the race completely?
> 
> 					udev sets 660
> open does permission checks
> 					device disappears
> 					chmod 000
> 					new device appears
> 					udev chmods 600
> open returns new device

Yes, there's still a small hole there.

We could check nlink != 0 after grabbing the device (untested patch).
That is a hack, however, and would break apps which previously relied
on being able to re-open already deleted devices through /proc/*/fd.
But there might not be a better solution...  Thoughts?

Thanks,
Miklos


Index: linux-2.6/fs/char_dev.c
===================================================================
--- linux-2.6.orig/fs/char_dev.c	2009-09-24 20:10:58.000000000 +0200
+++ linux-2.6/fs/char_dev.c	2009-11-16 12:48:58.000000000 +0100
@@ -396,6 +396,16 @@ static int chrdev_open(struct inode *ino
 	if (ret)
 		return ret;
 
+	/*
+	 * The device might have been removed and then reused while
+	 * the open was in progress.  Make sure we don't let open
+	 * proceed in such a case, since the old device could have had
+	 * different permissions.
+	 */
+	ret = -ENOENT;
+	if (inode->i_nlink == 0)
+		goto out_cdev_put;
+
 	ret = -ENXIO;
 	filp->f_op = fops_get(p->ops);
 	if (!filp->f_op)
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/