linux-kernel - Re: [RFC] Android Logger vs. Shared Memory FIGHT!

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <4F74A7E1.3010500@am.sony.com>
Date:	Thu, 29 Mar 2012 11:20:17 -0700
From:	Tim Bird <tim.bird@...sony.com>
To:	Daniel Walker <dwalker@...o99.com>
CC:	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	"kernel-team@...roid.com" <kernel-team@...roid.com>
Subject: Re: [RFC] Android Logger vs. Shared Memory FIGHT!

On 3/29/2012 10:52 AM, Daniel Walker wrote:
> On Thu, Mar 29, 2012 at 09:25:26AM -0700, Tim Bird wrote:
>> At the moment, I'm not considering an alternative for logger that runs
>> completely in user-space.  Having said that, this test is certainly interesting,
>> and may provide some performance numbers for logger or alternatives that would
>> be useful to compare.
>
> I was just thinking what does an accurate PID actually get you? If you
> looking at some logs with a PID of 20048, does that mean something to
> you? It doesn't actually mean much because you can't map that back to
> anything. If you have the device, and the process is still running then
> you could look it up ..
>
> So lets say logger was modified to record comm values.. That way you
> could record the actual process name AND the pid. Well if you use
> prctl(PR_SET_NAME), you can forge comm values. So that doesn't get you
> much either..
>
> So even if you record accurate PID values, it doesn't mean anything
> anyway.
Putting bogus pids in the log would allow a log DDOS-er to hide their
activity more easily.  But with the log in user-space, there are much more
insidious things that could be done to hide or corrupt log activity.  So
the sensitivity of this particular piece of log data is not that great.
  -- Tim


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/