linux-kernel - Re: [RFC 2/2] fs,proc: Respect FMODE

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CALCETrWCYB0fvCMYRySqbpYu42ph1cQfF3yVNDicvtHHSASp1A@mail.gmail.com>
Date:	Tue, 22 Apr 2014 10:05:23 -0700
From:	Andy Lutomirski <luto@...capital.net>
To:	David Herrmann <dh.herrmann@...il.com>
Cc:	Pavel Machek <pavel@....cz>,
	linux-kernel <linux-kernel@...r.kernel.org>,
	linux-fsdevel <linux-fsdevel@...r.kernel.org>,
	Alexander Viro <viro@...iv.linux.org.uk>,
	"Theodore Ts'o" <tytso@....edu>
Subject: Re: [RFC 2/2] fs,proc: Respect FMODE_WRITE when opening /proc/pid/fd/N

On Tue, Apr 22, 2014 at 9:44 AM, David Herrmann <dh.herrmann@...il.com> wrote:
> Hi
>
> On Tue, Apr 22, 2014 at 5:24 PM, Andy Lutomirski <luto@...capital.net> wrote:
>> On Tue, Apr 22, 2014 at 8:19 AM, David Herrmann <dh.herrmann@...il.com> wrote:
>>> In other words, the bug you describe is that /proc/pid/fd/ allows
>>> access to objects without a reachable path to the only _real_
>>> filesystem link. But isn't the same true for openat()?
>>
>> I don't think so.  openat doesn't work on fds for things that aren't
>> directories.
>
> Sorry, I wasn't precise enough: I meant the same 'leak' occurs if you
> keep a dir-fd on the directory in question _before_ it is set to 0600.
> Just like the example race keeps a file-fd to the file in question. So
> after the directory is set to 0600 you can use that dir-fd via
> openat() to avoid the whole path-lookup just like you do it via /proc.
>

I think this doesn't work -- fds pointing at directories don't capture
execute permission the way fds pointing at files can capture write
permission.  This is similar to the way that ls fails if you chmod 000
'.'.  Yes, it's weird.

--Andy
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/