linux-kernel - Re: procfs: boot- and runtime configurable access mode for /proc/<pid> dirs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <4D8B991E.5070604@nachtgeist.net>
Date:	Thu, 24 Mar 2011 20:18:54 +0100
From:	Daniel Reichelt <debian@...htgeist.net>
To:	linux-kernel@...r.kernel.org
Subject: Re: procfs: boot- and runtime configurable access mode for /proc/<pid>
 dirs

> More to the point, permissions in /proc/<pid>/* don't do us much good.
> As the matter of fact, we ought to make them all flat - i.e. same for
> user/group/other, since we have to recheck access rights on every damn
> IO operations.  Checks done at open() are useless here - have the
> task exec suid-root binary and they are obsolete.

Well, my patch is about modes of the pid-dirs themselves, not their
contents. And it changes procfs' behaviour about modes both on initial
creation and during revalidation on access. However flattening all the
piddir's entries DOES pose a security risk. Have a look at the
"traditional behaviour": piddir world-readable, however e.g.
<pid>/environ isn't. Often it's a workaround for broken software to
specify a password within an environment variable instead of by cmdline.
Since up until now all processes including their full cmdlines are
visible to everyone, environ must be considered more sensitive than a
cmdline.

The security implications are taken care of by my patch. The more
restrictive the modes for the piddir, the less access to its contents.
So from a security point of view, my patch takes care of that and IMHO
there's no need to put hands on the procfs' management of modes for
piddir-contents.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/