linux-kernel - Re: [PATCH 1/1 v2 ] ipmi: Setting OS name as Linux in BMC

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <4FF3D090.8000403@dell.com>
Date:	Tue, 3 Jul 2012 22:11:44 -0700
From:	<Srinivas_G_Gowda@...l.com>
To:	<minyard@....org>
CC:	<tcminyard@...il.com>, <mjg59@...f.ucam.org>,
	<andi@...stfloor.org>, <linux-kernel@...r.kernel.org>,
	<openipmi-developer@...ts.sourceforge.net>, <jharg93@...il.com>
Subject: Re: [PATCH 1/1 v2 ] ipmi: Setting OS name as Linux in BMC

On 06/29/2012 07:57 PM, Corey Minyard wrote:
>  seems to me that it's better to directly query what is running on the 
> target to know what is running on it, but perhaps that's a security 
> problem waiting to happen.  And perhaps it's better to have a small 
> program set this at startup, since this operation will currently fail on 
> the majority of systems out there.

Hi All,
The intend of this patch was not to really workaround any issues, the aim was for the management software to use this data. I think Corey summed it up pretty well in his previous comment. Management software associated with BMC usually use this information to let the users know about the OS that is using the BMC. Generally there are 3rd party application software that goes and pretty much fills up the OS env information and the management software uses this. My intend was why don't we get this information loaded by the driver itself. If there are applications that wants to rewrite it, so be it..! 
Rather than just have a static entry such as 'Linux' I could probably write the version number and more(distro name etc.. ) 

Thoughts.. ? 

I know there were some concerns with the security aspect, Can you please let me know what kind of security holes we could be looking at ? 

Thanks,
G

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/