linux-kernel - Re: [PATCH] proc: revert /proc/*/cmdline rewrite

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20190714095157.GA2276@avx2>
Date:   Sun, 14 Jul 2019 12:51:57 +0300
From:   Alexey Dobriyan <adobriyan@...il.com>
To:     Linus Torvalds <torvalds@...ux-foundation.org>
Cc:     Andrew Morton <akpm@...ux-foundation.org>, izbyshev@...ras.ru,
        Oleg Nesterov <oleg@...hat.com>,
        Michal Kubecek <mkubecek@...e.cz>, shasta@...corp.com,
        linux-kernel@...r.kernel.org, security@...nel.org
Subject: Re: [PATCH] proc: revert /proc/*/cmdline rewrite

	[re-add lists]

On Sat, Jul 13, 2019 at 10:50:20AM -0700, Linus Torvalds wrote:
> On Sat, Jul 13, 2019 at 12:29 AM Alexey Dobriyan <adobriyan@...il.com> wrote:
> >
> > /proc/*/cmdline continues to cause problems:
> 
> If we're reverting this, then we should revert all the way back to the
> original fixed-length one that had the original semantics and was
> simple.

No, because all those Java applications have command lines measured in
dozens of kilobytes.

> What was the problem with the one-line fix instead?

The problem is that I can't even drag this trivia in out of _fear_ that
it is userspace observable:

	https://marc.info/?t=155863429700002&r=1&w=4
	[PATCH] elf: fix "start_code" evaluation

and yet the patch which did a regression and an infoleak continues
to be papered over and for which the only justification was
"simplify and clarify".