linux-kernel - Re: [PATCH v4] kernel: add kcov code coverage

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20160119130543.GB20984@node.shutemov.name>
Date:	Tue, 19 Jan 2016 15:05:43 +0200
From:	"Kirill A. Shutemov" <kirill@...temov.name>
To:	Dmitry Vyukov <dvyukov@...gle.com>
Cc:	syzkaller <syzkaller@...glegroups.com>,
	Vegard Nossum <vegard.nossum@...cle.com>,
	Catalin Marinas <catalin.marinas@....com>,
	Tavis Ormandy <taviso@...gle.com>,
	Will Deacon <will.deacon@....com>,
	LKML <linux-kernel@...r.kernel.org>,
	Quentin Casasnovas <quentin.casasnovas@...cle.com>,
	Kostya Serebryany <kcc@...gle.com>,
	Eric Dumazet <edumazet@...gle.com>,
	Alexander Potapenko <glider@...gle.com>,
	Kees Cook <keescook@...gle.com>,
	Bjorn Helgaas <bhelgaas@...gle.com>,
	Sasha Levin <sasha.levin@...cle.com>,
	Andrew Morton <akpm@...ux-foundation.org>,
	David Drysdale <drysdale@...gle.com>,
	linux-arm-kernel@...ts.infradead.org,
	Ard Biesheuvel <ard.biesheuvel@...aro.org>,
	Andrey Ryabinin <ryabinin.a.a@...il.com>
Subject: Re: [PATCH v4] kernel: add kcov code coverage

On Tue, Jan 19, 2016 at 01:55:43PM +0100, Dmitry Vyukov wrote:
> >> +static int __init kcov_init(void)
> >> +{
> >> +     if (!debugfs_create_file("kcov", 0666, NULL, NULL, &kcov_fops)) {
> >
> > Why 0666? May be 0600?.
> 
> The idea is that it can be useful to fuzz-test under a normal user as well.
> This file is also guarded by debugfs mount permissions. Usually it is mounted
> as 0700, so normal users can't get access to it.
> However if one wants to fuzz-test under a normal user, he could mount
> debugfs as 0777 and get access to this file.
> 
> I am not very strong about this, though. If you say, I will change it to 0600.
> I open this file as root at the moment. And we can change it back
> if/when we better understand a potential use case.

I think it's safer to make it 0600. It's up to system administrator to
change permissions, if he wants give this capability to mortals.

-- 
 Kirill A. Shutemov