linux-kernel - Re: [PATCH v2 0/9] procfs: protect /proc/<pid>/* files with file->f

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20131003125609.GB3619@dztty>
Date:	Thu, 3 Oct 2013 13:56:09 +0100
From:	Djalal Harouni <tixxdz@...ndz.org>
To:	Ingo Molnar <mingo@...nel.org>
Cc:	Andy Lutomirski <luto@...capital.net>,
	"Eric W. Biederman" <ebiederm@...ssion.com>,
	Kees Cook <keescook@...omium.org>,
	Al Viro <viro@...iv.linux.org.uk>,
	Andrew Morton <akpm@...ux-foundation.org>,
	Linus Torvalds <torvalds@...ux-foundation.org>,
	"Serge E. Hallyn" <serge.hallyn@...ntu.com>,
	Cyrill Gorcunov <gorcunov@...nvz.org>,
	David Rientjes <rientjes@...gle.com>,
	LKML <linux-kernel@...r.kernel.org>,
	Linux FS Devel <linux-fsdevel@...r.kernel.org>,
	kernel-hardening@...ts.openwall.com,
	Djalal Harouni <tixxdz@...il.com>
Subject: Re: [PATCH v2 0/9] procfs: protect /proc/<pid>/* files with
 file->f_cred

On Thu, Oct 03, 2013 at 08:22:56AM +0200, Ingo Molnar wrote:
> 
> * Djalal Harouni <tixxdz@...ndz.org> wrote:
> 
> >  * You can't do it for /proc/*/stat otherwise you will break userspace
> >   "ps"..., ps must access /proc/1/stat etc... so the proposed solution
> >   will work without any side effect.
> 
> The thing is, returning -EINVAL is not the only way to reject access to 
> privileged information!

> In the /proc/1/stat case a compatibility quirk can solve the problem: 
> create a special 'dummy' process inode for invalid accesses and give it to 
> ps, with all fields present but zero.
Hmm, we already return zero for the fields that must be protected.
Already done.
Not all fields need to be zero ?  If so, yes it could be done as you
propose and avoid the 'if permitted' test each time... but we don't want
to do it


> >   And for /proc/*/maps you will perhaps break glibc under certain
> >   situations... so just hold it for the moment and test it
> >   later. There have been reports in the past about it.
> 
> Same deal: just create a dummy compat-quirk maps inode with constant, zero 
> information contents to placate old user-space:
> 
>  00000000-00000000 ---p 00000000 00:00 0
> 
> [ Or whatever line is needed to minimally not break old userspace. ]
> 
> But don't leak privileged information!
> 
> ( Maybe add a CONFIG_PROC_FS_COMPAT_QUIRKS Kconfig option, default-y for 
>   now, that new/sane userspace can turn off. )
Yes, that could work, but I'm not sure (it depends on what glibc is
doing and what info it needs)

With the right permission checks, and glibc tests, this will be nice!

> Thanks,
> 
> 	Ingo

-- 
Djalal Harouni
http://opendz.org
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/