linux-kernel - Re: [PATCH] trivial: make mmap_min

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20100421182911.GB13524@outflux.net>
Date:	Wed, 21 Apr 2010 11:29:11 -0700
From:	Kees Cook <kees@...onical.com>
To:	Kyle McMartin <kmcmartin@...hat.com>
Cc:	eparis@...hat.com, cebbert@...hat.com, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] trivial: make mmap_min_addr perms 600

On Wed, Apr 21, 2010 at 10:00:33AM -0400, Kyle McMartin wrote:
> Chuck points out that mmap_min_addr is 644...
> CAP_SYS_RAWIO will deny users read/write to the file, let's let them see
> that this is intended.

Hmm.  Denying read is actually an unintended side-effect of the
CAP_SYS_RAWIO check.

The value is useful information for an admin to see without being root
("is my system vulnerable to kernel NULL pointer attacks?") and its
setting is trivially easy for an attacker to determine by calling mmap()
in PAGE_SIZE increments starting at 0.

I would opt for greater transparency for the admin, and leave it 644 and
instead more carefully check CAP_SYS_RAWIO.

Signed-off-by: Kees Cook <kees.cook@...onical.com>
---
 security/min_addr.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/security/min_addr.c b/security/min_addr.c
index e86f297..f728728 100644
--- a/security/min_addr.c
+++ b/security/min_addr.c
@@ -33,7 +33,7 @@ int mmap_min_addr_handler(struct ctl_table *table, int write,
 {
 	int ret;
 
-	if (!capable(CAP_SYS_RAWIO))
+	if (write && !capable(CAP_SYS_RAWIO))
 		return -EPERM;
 
 	ret = proc_doulongvec_minmax(table, write, buffer, lenp, ppos);
-- 
1.7.0.4


-- 
Kees Cook
Ubuntu Security Team
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/