linux-kernel - Re: [RFC] syscalls, x86: Add __NR

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 18 Jan 2012 15:29:50 -0800
From:	ebiederm@...ssion.com (Eric W. Biederman)
To:	Cyrill Gorcunov <gorcunov@...il.com>
Cc:	david@...g.hm, "H. Peter Anvin" <hpa@...or.com>,
	Alexey Dobriyan <adobriyan@...il.com>,
	LKML <linux-kernel@...r.kernel.org>,
	Pavel Emelyanov <xemul@...allels.com>,
	Andrey Vagin <avagin@...nvz.org>, Ingo Molnar <mingo@...e.hu>,
	Thomas Gleixner <tglx@...utronix.de>,
	Glauber Costa <glommer@...allels.com>,
	Andi Kleen <andi@...stfloor.org>, Tejun Heo <tj@...nel.org>,
	Matt Helsley <matthltc@...ibm.com>,
	Pekka Enberg <penberg@...nel.org>,
	Eric Dumazet <eric.dumazet@...il.com>,
	Vasiliy Kulikov <segoon@...nwall.com>,
	Andrew Morton <akpm@...ux-foundation.org>,
	Valdis.Kletnieks@...edu
Subject: Re: [RFC] syscalls, x86: Add __NR_kcmp syscall

Cyrill Gorcunov <gorcunov@...il.com> writes:

> On Wed, Jan 18, 2012 at 02:05:31PM -0800, david@...g.hm wrote:
> ...
>> >>
>> >>Why on Earth would user space need to know which order in memory certain
>> >>kernel objects are?
>> >
>> >For checkpoint restart and for some other kinds of introspection what is
>> >needed is a comparison function to see if two processes share the same
>> >object.  The most interesting of these objects from a checkpoint restart case
>> >are file descriptors, and there can be a lot of file descriptors.
>> >
>> >The order in memory does not matter.  What does matter is that the
>> >comparison function return some ordering between objects.  The algorithm
>> >for figuring out of N items which of them are duplicates is O(N^2) if
>> >the comparison function can only return equal or not equal.  The
>> >algorithm for finding duplications is only O(NlogN) if the comparison
>> >function will return an ordering among the objects.
>> 
>> so what you really want is a syscall that can take a list of objects
>> instead of having to do a syscall per object. right?
>> 
>
> It doesn't matter. Even if we take a list of objects the kernel either
> should return us some ordering info or find duplicates, in any case it
> makes things more complex i think. So we wanted to bring some minimum
> into kernel leaving the rest of work to user-space.

Agreed a syscall does the duplication is probably not the way to go.

 A syscall that takes a huge list of objects would solve any security
concerns that we have with returning the object order to user space if
done carefully, but it would require a bunch of additional user space
and kernel memory.

Sometimes taking a data structure transforming it into a weird form for
a specific task and then transforming the data structure back to it's
original form is a useful way to go.  So I think a general kernel object
deduplicating system call is an interesting plan B, but a straight
comparison function if we can make it work is a lot more flexible and
useful.

Eric
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/