| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-Id: <E1NFva6-0001AI-0J@pomaz-ex.szeredi.hu> Date: Wed, 02 Dec 2009 21:13:46 +0100 From: Miklos Szeredi <miklos@...redi.hu> To: Alan Cox <alan@...rguk.ukuu.org.uk> CC: miklos@...redi.hu, akpm@...ux-foundation.org, viro@...IV.linux.org.uk, dhowells@...hat.com, hch@...radead.org, adilger@....com, mtk.manpages@...il.com, torvalds@...ux-foundation.org, drepper@...il.com, jamie@...reable.org, linux-fsdevel@...r.kernel.org, linux-kernel@...r.kernel.org Subject: Re: [PATCH v3] vfs: new O_NODE open flag On Wed, 2 Dec 2009, Alan Cox wrote: > > 1) There's a security hole with dynamicly allocated devices if > > permissions on new device are difference than on old device. > > > > The issue is valid, but also exists if hard links are created to > > device nodes. udev already defends against this by setting > > permissions on device to zero before unlinking it. > > udev defends against it with the specific knowledge that any existing > open means the device is open and cannot be unloaded. The combination is > required (and some other happenstance properties). You're still missing the point. O_NODE is like a hard link, except the reference doesn't come from the filesystem but from a file descriptor. From udev's perspective there's no difference. Miklos -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists