linux-kernel - Re: [PATCH 2/2] mm: restrict access to /proc/meminfo

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20110930195329.GA2020@albatros>
Date:	Fri, 30 Sep 2011 23:53:29 +0400
From:	Vasiliy Kulikov <segoon@...nwall.com>
To:	Andrew Morton <akpm00@...il.com>
Cc:	kernel-hardening@...ts.openwall.com,
	Christoph Lameter <cl@...ux-foundation.org>,
	Pekka Enberg <penberg@...nel.org>,
	Matt Mackall <mpm@...enic.com>, linux-mm@...ck.org,
	Kees Cook <kees@...ntu.com>,
	Dave Hansen <dave@...ux.vnet.ibm.com>, Valdis.Kletnieks@...edu,
	Linus Torvalds <torvalds@...ux-foundation.org>,
	David Rientjes <rientjes@...gle.com>,
	Alan Cox <alan@...ux.intel.com>, linux-kernel@...r.kernel.org,
	Andrew Morton <akpm@...ux-foundation.org>
Subject: Re: [PATCH 2/2] mm: restrict access to /proc/meminfo

On Wed, Sep 28, 2011 at 14:46 -0700, Andrew Morton wrote:
> On Tue, 27 Sep 2011 23:38:10 +0400
> Vasiliy Kulikov <segoon@...nwall.com> wrote:
> 
> > On Tue, Sep 27, 2011 at 21:56 +0400, Vasiliy Kulikov wrote:
> > > /proc/meminfo stores information related to memory pages usage, which
> > > may be used to monitor the number of objects in specific caches (and/or
> > > the changes of these numbers).  This might reveal private information
> > > similar to /proc/slabinfo infoleaks.  To remove the infoleak, just
> > > restrict meminfo to root.  If it is used by unprivileged daemons,
> > > meminfo permissions can be altered the same way as slabinfo:
> > > 
> > >     groupadd meminfo
> > >     usermod -a -G meminfo $MONITOR_USER
> > >     chmod g+r /proc/meminfo
> > >     chgrp meminfo /proc/meminfo
> > 
> > Just to make it clear: since this patch breaks "free", I don't propose
> > it anymore.
> 
> It will break top(1) too.  It isn't my favoritest-ever patch :)

FWIW, I consider it as a top's bug.  It tries to handle failed open(),
but forgets to reset tty mode.

Anyway, how do we expect userspace apps handle meminfo data?  Is it used
as a debugging information only?  E.g. admin wants to see how much
memory is used, monitoring daemon looks for memleaks and running out of
memory (1)?  Or the numbers are used in some calculations e.g.
calculation of approximate number of parallel processes to spawn (2)?

If we care about (1) only, we may do the same as we do with kernel
pointers, i.e. show zeroes to non-CAP_SYS_ADMIN users (plus emit a
sinlge warning in syslog).  It will not break top, and top will simply
show zero counters.  Admins who still want to read this information as
non-root should chmod/chgrp it in boot scripts.  (And distros should
provide a default "debugging" group for these needs.)

If we care about (2), we should pass non-zero counters, but imagine some
default values, which will result in sane processes numbers.  But it
might depend on specific applications, I'm not aware whether (2) is
real.

Other ideas?

-- 
Vasiliy Kulikov
http://www.openwall.com - bringing security into open computing environments
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/