linux-kernel - Re: [PATCH 1/2] proc: restrict access to /proc/PID/io

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20110629112045.GA29011@albatros>
Date:	Wed, 29 Jun 2011 15:20:45 +0400
From:	Vasiliy Kulikov <segoon@...nwall.com>
To:	Balbir Singh <bsingharora@...il.com>
Cc:	KOSAKI Motohiro <kosaki.motohiro@...fujitsu.com>,
	linux-kernel@...r.kernel.org, balbir@...ux.vnet.ibm.com,
	akpm@...ux-foundation.org, viro@...iv.linux.org.uk,
	rientjes@...gle.com, wilsons@...rt.ca, security@...nel.org,
	eparis@...hat.com, kernel-hardening@...ts.openwall.com,
	Linus Torvalds <torvalds@...ux-foundation.org>
Subject: Re: [PATCH 1/2] proc: restrict access to /proc/PID/io

On Wed, Jun 29, 2011 at 06:46 +0530, Balbir Singh wrote:
> On Tue, Jun 28, 2011 at 1:20 PM, Vasiliy Kulikov <segoon@...nwall.com> wrote:
> > On Tue, Jun 28, 2011 at 06:54 +0530, Balbir Singh wrote:
> >> > As to rounding - this is a workaround, not a fix.  What if some program
> >> > reads one byte from tty and then do some io activity exactly of 1kb-1?
> >> > Then you just measure kbs and get original tty activity.  (just a crazy
> >> > example to show that it is not a full solution.)
> >> >
> >>
> >> That would happen with a probability of 1/1024
> >
> > I'd not claim about probability here, but anyway rounding would be not
> > a fix, just a workaround.  Also note that the random value is program
> > dependent, it is not chosen at the program start time or anything
> > similar.  IOW, if the program is vulnerable, it is vulnerable with 100%
> > probability.
> >
> 
> I was thinking along ASLR lines, ASLR reduces the probability of
> malware finding specific address in code, but does not eliminate it
> completely.

You confuse a bug fix with a prevention of an exploitation technique
here.  ASLR doesn't fix anything, it tries to break exploits that use
bugs like arbitrary writes/reads.  If there is arbitrary write bug,
almost always the game is over; that's why such probabilistic measure is
acceptable.  On the contrary, /proc/*/io leak is a bug, which is fairly
fixable by restricting an access (breaking programs, though).  So, from
the security point of view these cases are not comparable.


> In the worst case as you suggest may
> be the statistics would be available only to root, but that is the
> final drop down scenario.

Yes, it breaks iotop, but it is a full solution.


> No we don't clear taskstats info on credential changes.

If taskstats info is allowed to travel through credential changes, it
exposes the similar private information.


Thanks,

-- 
Vasiliy Kulikov
http://www.openwall.com - bringing security into open computing environments
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/