linux-kernel - Re: [RFC] add mount options to sysfs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 19 May 2011 10:12:27 -0700
From:	Greg KH <gregkh@...e.de>
To:	Vasiliy Kulikov <segoon@...nwall.com>
Cc:	linux-kernel@...r.kernel.org, Kees Cook <kees.cook@...onical.com>,
	Eugene Teo <eugeneteo@...il.com>
Subject: Re: [RFC] add mount options to sysfs

On Thu, May 19, 2011 at 10:26:23AM +0400, Vasiliy Kulikov wrote:
> On Wed, May 18, 2011 at 12:17 -0700, Greg KH wrote:
> > > 1) *IF* another sensitive file with weird permissions is found, mount
> > > option is IMO the best temporary workaround.
> > 
> > Maybe, but fixing the file would be the obvious solution.
> 
> I mean for a sysadmin, not for a developer.

And I mean for the developer.

We have checks in place now to prevent this type of thing from happening
again in the future.  If it does, and it might, we will fix it, it's
that simple.

> What do you mean by "breaking system"?  Root is able to chmod
> and chown sysfs files already, he may do "chmod -R" or similar.
> I suggest sane, race free way to globally restrict permissions *IF* root
> wants it.

If root wants it, they can do this today with a simple 1 line bash
command, so I don't see the issue.

> Here https://lkml.org/lkml/2011/2/25/300 you, not aware of usefull
> applications of world-writable debugfs file, agreeded to statically
> restrict permissions of all files.  I suggest more flexible and
> configurable in runtime solution.  It doesn't break anything - default
> behaviour doesn't differ from current one.  What has changed in your
> mind since 2/25?

That's debugfs, not sysfs, which we are talking about here, right?

thanks,

greg k-h
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/