linux-kernel - Re: [RFC] Android Logger vs. Shared Memory FIGHT!

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 29 Mar 2012 19:50:07 +0100
From:	Alan Cox <alan@...rguk.ukuu.org.uk>
To:	Daniel Walker <dwalker@...o99.com>
Cc:	Tim Bird <tim.bird@...sony.com>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	"kernel-team@...roid.com" <kernel-team@...roid.com>
Subject: Re: [RFC] Android Logger vs. Shared Memory FIGHT!

On Thu, 29 Mar 2012 10:52:10 -0700
Daniel Walker <dwalker@...o99.com> wrote:

> On Thu, Mar 29, 2012 at 09:25:26AM -0700, Tim Bird wrote:
> > At the moment, I'm not considering an alternative for logger that runs
> > completely in user-space.  Having said that, this test is certainly interesting,
> > and may provide some performance numbers for logger or alternatives that would
> > be useful to compare.
> 
> 
> I was just thinking what does an accurate PID actually get you? If you
> looking at some logs with a PID of 20048, does that mean something to
> you? It doesn't actually mean much because you can't map that back to
> anything. If you have the device, and the process is still running then
> you could look it up ..
> 
> So lets say logger was modified to record comm values.. That way you
> could record the actual process name AND the pid. Well if you use
> prctl(PR_SET_NAME), you can forge comm values. So that doesn't get you
> much either..
> 
> So even if you record accurate PID values, it doesn't mean anything
> anyway.

The question is whether you are trying to record data for analysis in a
hostile environment or you are trying to do useful debugging. If your
apps are non hostile then PR_SET_NAME is actually useful in logging to
split apart different executions of the same daemon.

The Android logger has no security model of any real kind so it's clearly
about the debug side. In that case the PID lets you correlate with other
logs, the comm data might be useful.

Alan
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/