linux-kernel - Re: [RFC] SIGKILL vs. SIGSEGV on late execve() failures

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20130216012242.GZ4503@ZenIV.linux.org.uk>
Date:	Sat, 16 Feb 2013 01:22:42 +0000
From:	Al Viro <viro@...IV.linux.org.uk>
To:	Linus Torvalds <torvalds@...ux-foundation.org>
Cc:	Shentino <shentino@...il.com>,
	Linux Kernel Mailing List <linux-kernel@...r.kernel.org>
Subject: Re: [RFC] SIGKILL vs. SIGSEGV on late execve() failures

On Fri, Feb 15, 2013 at 04:40:18PM -0800, Linus Torvalds wrote:
> On Fri, Feb 15, 2013 at 4:04 PM, Al Viro <viro@...iv.linux.org.uk> wrote:
> > On Fri, Feb 15, 2013 at 03:12:30PM -0800, Shentino wrote:
> >> > +                               send_sig(SIGSEGV, current, 0);
> >>
> >> This might be a stupid miscue on my part, but shouldn't it be
> >> force_sig instead of send_sig?
> >>
> >> I've got this crazy hunch that having SEGV masked might muck something up.
> >
> > How would you manage to have it masked at that point?  setup_new_exec()
> > is inevitable after success of flush_old_exec() and it will do
> > flush_signal_handlers() for us.
> 
> I have to agree with Shentino on this one: it's entirely possible that
> send_sig() is always equivalent to force_sig() in this circumstance,
> but rather than depend on that kind of non-local subtlety, we should
> just make it obvious. This is what "force_sig()" exists for - making
> it clear that we punch through any signal handlers. Whether such a
> signal handler can exist or not is kind of immaterial.

*shrug*

Fine by me - the variant I'd posted simply moved these calls in one
place; I've no problem with replacing them with force_sig() (or
force_sigsegv(SIGSEGV, current), for paranoia sake).  OTOH, I'd probably
prefer to make it a separate commit.

FWIW, now that I've looked into what's involved in merging flush_old_exec()
and setup_new_exec()...  Here's something that looks like a bug:
#include <sys/personality.h>
#include <unistd.h>
main()
{
	char *argv[] = {"uname", "-m", "-r", NULL};
	char *envp[] = {NULL};
	personality(0x0020000);	/* UNAME26 */
	execve("/bin/uname", argv, envp);
}

On amd64 testbox (3.0.60-based kernel):
2.6.40+ x86_64
On alpha:
3.3.6+ alpha

Cause: SET_PERSONALITY() on alpha doesn't care to preserve the upper bits
of current->personality and just does either set_personality(PER_LINUX) or
set_personality(PER_LINUX_32BIT).
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/