linux-kernel - Seed /proc nodes before they are created

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:	Sat, 10 Sep 2011 10:17:40 +0200
From:	martin f krafft <madduck@...duck.net>
To:	linux kernel mailing list <linux-kernel@...r.kernel.org>
Subject: Seed /proc nodes before they are created

Dear kernel people,

I've been trying to come up with sensible ways to control the
settings exposed via procfs for years. I have tried everything
between sysctl, systune, writing values directly wit hooks, and even
using puppet to manage the "content" of the procfs "files".

Unfortunately, none of the solutions are satisfactory, really. If
I run sysctl during boot, it either runs too early (some modules not
yet loaded, or some interfaces not yet available) or too late
(networking already set up). Using hooks and manually writing procfs
nodes just feels like a hack and it's prone to errors, and puppet
is a nightmare — and only runs at intervals, so it leaves periods of
time in which the system might be in indeterminate states.

It occured to me that there might be a very simple solution to the
problem: couldn't I "pre-write" procfs (and sysfs) nodes, i.e.
create the nodes and write a value to them, and then, as soon as the
kernel learns about a setting, it uses the pre-written value to
initialise its internal representation of the value?

With this in place,

  - I could enable forwarding on certain interfaces long before they
    are brought up;

  - I could set RTC parameters before the module is loaded on
    demand;

  - I could disable rp_filter and enable e.g. IPv6 autoconf on my
    PPP interface before I start pppd;

etc.

Obviously, I could also abuse this to store arbitrary content in the
kernel memory space, but a creative root can do that anyway, and
a size limitation on individual nodes would limit this.

The implementation is probably not even too hard, since I am
assuming (but I do not know), that procfs nodes are somehow
centrally managed in the kernel.

What do people think about his idea?

-- 
martin | http://madduck.net/ | http://two.sentenc.es/

"menschen, welche rasch feuer fangen,
 werden schnell kalt und sind daher im ganzen unzuverlässig."
                                                 - friedrich nietzsche

spamtraps: madduck.bogus@...duck.net

Download attachment "digital_signature_gpg.asc" of type "application/pgp-signature" (1125 bytes)