lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Sat, 10 Jan 2015 20:09:10 -0600 From: ebiederm@...ssion.com (Eric W. Biederman) To: Rich Felker <dalias@...ifal.cx> Cc: Al Viro <viro@...IV.linux.org.uk>, David Drysdale <drysdale@...gle.com>, "Michael Kerrisk \(man-pages\)" <mtk.manpages@...il.com>, Andy Lutomirski <luto@...capital.net>, Meredydd Luff <meredydd@...atehouse.org>, "linux-kernel\@vger.kernel.org" <linux-kernel@...r.kernel.org>, Andrew Morton <akpm@...ux-foundation.org>, David Miller <davem@...emloft.net>, Thomas Gleixner <tglx@...utronix.de>, Stephen Rothwell <sfr@...b.auug.org.au>, Oleg Nesterov <oleg@...hat.com>, Ingo Molnar <mingo@...hat.com>, "H. Peter Anvin" <hpa@...or.com>, Kees Cook <keescook@...omium.org>, Arnd Bergmann <arnd@...db.de>, Christoph Hellwig <hch@...radead.org>, X86 ML <x86@...nel.org>, linux-arch <linux-arch@...r.kernel.org>, Linux API <linux-api@...r.kernel.org>, sparclinux@...r.kernel.org Subject: Re: [PATCHv10 man-pages 5/5] execveat.2: initial man page for execveat(2) Rich Felker <dalias@...ifal.cx> writes: > On Sat, Jan 10, 2015 at 04:27:23PM -0600, Eric W. Biederman wrote: >> Rich Felker <dalias@...ifal.cx> writes: >> >> > On Sat, Jan 10, 2015 at 04:14:57AM +0000, Al Viro wrote: >> >> >> Except that if your interpreter does stat(2) (or access(2), or getxattr(2), >> >> etc.) before bothering with open(2), you'll get screwed. >> > >> > Yes, but I think that would be very bad interpreter design. >> > stat/getxattr/access/whatever followed by open is always a TOCTOU >> > race. The correct sequence of actions is always open followed by >> > fstat/fgetxattr/... >> >> Sigh. I think everyone who has looked at this has been blind. >> >> If userspace is reasonable all we have to do is fix /proc/self/exe >> for shell scripts to point at the actual script, >> and then pass /proc/self/exe on the shell scripts command line. >> >> At a practical level we have to worry about backwards compability and >> chroot jails. But the existence of a clean implementation with >> /proc/self/exe serves a proof of concept that it would not be too >> difficult. When someone cares enough to implement it. > > Is /proc/self/exe a "magic symlink" that's bound to the inode, or just > a regular symlink? In the latter case it defeats the whole purpose of > using O_EXEC fds and fexecve rather than pathnames. In implementation /proc/self/exe is a named rather than a numbered file descriptor. Essentially when loading an elf executable the file descriptor is duped to the name /proc/self/exe. The implementation otherwise is the same as /proc/self/fd/N. The downside of course is that I expect if we were actually to change /proc/self/exe from to point at the script instead of the shell some piece of software somewhere would come melting down. I am totally not ready to consider that kind of mine field today. Eric -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists