linux-kernel - Re: [FYI] tux3: Core changes

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20150527213715.GA15721@amd>
Date:	Wed, 27 May 2015 23:37:15 +0200
From:	Pavel Machek <pavel@....cz>
To:	Daniel Phillips <daniel@...nq.net>
Cc:	Rik van Riel <riel@...hat.com>, linux-kernel@...r.kernel.org,
	linux-fsdevel@...r.kernel.org, tux3@...3.org,
	OGAWA Hirofumi <hirofumi@...l.parknet.co.jp>, mgorman@...e.de,
	Andrea Arcangeli <aarcange@...hat.com>,
	Peter Zijlstra <peterz@...radead.org>
Subject: Re: [FYI] tux3: Core changes

On Wed 2015-05-27 11:09:25, Daniel Phillips wrote:
> On Wednesday, May 27, 2015 12:41:37 AM PDT, Pavel Machek wrote:
> >On Fri 2015-05-15 02:38:33, Daniel Phillips wrote:
> >>On 05/14/2015 08:06 PM, Rik van Riel wrote: ...
> >
> >Umm. Why do you think it is only issue for executable files?
> 
> I meant: files with code in them, that will be executed. Please excuse
> me for colliding with the chmod sense. I will say "code files" to avoid
> ambiguity.
> 
> >I'm free to mmap() any file, and then execute from it.
> >
> >/lib/ld-linux.so /path/to/binary
> >
> >is known way to exec programs that do not have x bit set.
> 
> So... why would I write to a code file at the same time as stepping
> through it with ptrace? Should I expect ptrace to work perfectly if
> I do that? What would "work perfectly" mean, if the code is changing
> at the same time as being traced?

Do you have any imagination at all?

Reasons I should expect ptrace to work perfectly if I'm writing to
file:

1) it used to work before

2) it used to work before

3) it used to work before and regressions are not allowed

4) some kind of just in time compiler

5) some kind of malware, playing tricks so that you have trouble
analyzing it

and of course,

6) it used to work before.

									Pavel
-- 
(english) http://www.livejournal.com/~pavelmachek
(cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/