linux-kernel - Re: [PATCH] KEYS: prevent creating a different user's keyrings

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20170921220029.GB89627@gmail.com>
Date:   Thu, 21 Sep 2017 15:00:29 -0700
From:   Eric Biggers <ebiggers3@...il.com>
To:     David Howells <dhowells@...hat.com>
Cc:     keyrings@...r.kernel.org, Michael Halcrow <mhalcrow@...gle.com>,
        linux-security-module@...r.kernel.org,
        linux-kernel@...r.kernel.org, Eric Biggers <ebiggers@...gle.com>,
        stable@...r.kernel.org
Subject: Re: [PATCH] KEYS: prevent creating a different user's keyrings

On Tue, Sep 19, 2017 at 05:05:20PM +0100, David Howells wrote:
> Eric Biggers <ebiggers3@...il.com> wrote:
> 
> > Fix it by marking user and user session keyrings with a flag
> > KEY_FLAG_UID_KEYRING.  Then, when searching for a user or user session
> > keyring by name, skip all keyrings that don't have the flag set.
> 
> I wonder if it's better just to reject attempts to manually create/join
> keyrings of such names.  PAM uses the implicit creation method of specifying
> the 'macro' key IDs for these keyrings.
> 
> David

Well, maybe.  Whitelists are hard to get right, and it would be a bit ugly
having to check the name in both add_key() and join_session_keyring().  And
hopefully that would be everything?

I think there's also a more fundamental problem with how keyring names work.  If
you try to join a keyring with a certain name, how are you supposed to know
which one you're joining?  There can be many keyrings that have the same name;
and any unprivileged user can create a keyring with the name, and they can grant
everyone SEARCH permission so that their keyring can be joined.  So it can be
the case that a user is wanting to join a particular keyring, but they actually
get a keyring that a malicious user has crafted for them...

Also, if period ('.') is meant to be the reserved character in keyring names,
why do most of the special names actually start with underscore ('_')?

Eric