linux-kernel - Re: [PATCH 2/3] sys_personality: make sure (int)personality >= 0

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20100528190344.GA12090@redhat.com>
Date:	Fri, 28 May 2010 21:03:44 +0200
From:	Oleg Nesterov <oleg@...hat.com>
To:	"H. Peter Anvin" <hpa@...or.com>
Cc:	Roland McGrath <roland@...hat.com>,
	Andrew Morton <akpm@...ux-foundation.org>,
	Andi Kleen <andi@...stfloor.org>,
	Linus Torvalds <torvalds@...ux-foundation.org>,
	Richard Henderson <rth@...ddle.net>, wezhang@...hat.com,
	linux-kernel@...r.kernel.org,
	Michael Kerrisk <mtk.manpages@...il.com>,
	William Cohen <wcohen@...hat.com>
Subject: Re: [PATCH 2/3] sys_personality: make sure (int)personality >= 0

On 05/27, H. Peter Anvin wrote:
>
> On 05/27/2010 08:36 AM, Oleg Nesterov wrote:
> >
> > Change sys_personality() to ensure personality can not look like a
> > negative int. This disallows the MSB, it is not used for PER_ flags.
> >
> I'm fine with this, even though it is indeed there to support extremely
> poorly written applications (error is specifially -1, not < 0).

Completely agreed. I never liked this patch, just tried to discuss this
"problem" and report either ACK or NACK back to bugzilla.

Now I dislike it even more. I am not going to resend it, but I added
the fat note to the patch-v2 I am sending.

> However, since we almost certainly have enough brokenness in here, and
> since there definitely don't seem to be a whole lot of demand for new
> personality bits, I'm more than happy to waste bit 31 at not having to
> deal with it, ever.
>
> However, it would be better if we returned -EINVAL on attempts to set
> *any* of the reserved bits, not just bit 31.

If only I knew what is the supposed behaviour of sys_personality ;)

Another reason to forget this patch but add the "right" check if needed.

Oleg.

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/