linux-kernel - Re: [PATCH v2] fs: block cross-uid sticky symlinks

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20100531175733.GD4098@outflux.net>
Date:	Mon, 31 May 2010 10:57:33 -0700
From:	Kees Cook <kees.cook@...onical.com>
To:	Christoph Hellwig <hch@...radead.org>
Cc:	linux-kernel@...r.kernel.org,
	linux-security-module@...r.kernel.org,
	linux-fsdevel@...r.kernel.org, linux-doc@...r.kernel.org,
	Randy Dunlap <rdunlap@...otime.net>,
	Andrew Morton <akpm@...ux-foundation.org>,
	Jiri Kosina <jkosina@...e.cz>,
	Dave Young <hidave.darkstar@...il.com>,
	Martin Schwidefsky <schwidefsky@...ibm.com>,
	James Morris <jmorris@...ei.org>,
	Eric Paris <eparis@...hat.com>,
	David Howells <dhowells@...hat.com>,
	Ingo Molnar <mingo@...e.hu>,
	Peter Zijlstra <a.p.zijlstra@...llo.nl>,
	"Eric W. Biederman" <ebiederm@...ssion.com>,
	Tim Gardner <tim.gardner@...onical.com>,
	"Serge E. Hallyn" <serue@...ibm.com>
Subject: Re: [PATCH v2] fs: block cross-uid sticky symlinks

Hi Christoph,

On Mon, May 31, 2010 at 06:35:10AM -0400, Christoph Hellwig wrote:
> NAK for changing this in core code.  These are long-living and
> documented semantics that we can't simply break, and as Alan mentioned
> having there's good enough workaround that don't break applications.

I totally disagree -- there are no applications that depend on this
behavior in sticky world-writable directories.  Adding this logic (where
ever it lands) fixes /tmp symlink races forever and breaks nothing.

> Feel free to shovel it into the crackpot LSM of your choice.

I have no strong opinion about where it should live.  The strong opinion
I have is that all Linux users, regardless of LSM choice, should benefit
from the fix.

I'd like to separate objections about implementation from objections about
the change in semantics itself.  If every user of Linux gains this symlink
protection, does it matter if it's in core VFS or in commoncaps?

Expecting the push-back from VFS, I wrote this patch against commoncaps.

James, would you take it there (along with the patch to SELinux to call
out to commoncaps) if there is no way to proceed with the VFS core towards
solving this?

Thanks,

-Kees

-- 
Kees Cook
Ubuntu Security Team
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/