linux-kernel - Re: [PATCH v4 2/2] proc: restrict /proc/pid/mem

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Mon, 27 May 2024 12:21:10 +0100
From: "Adrian Ratiu" <adrian.ratiu@...labora.com>
To: "Randy Dunlap" <rdunlap@...radead.org>
Cc: linux-fsdevel@...r.kernel.org, linux-security-module@...r.kernel.org, linux-kernel@...r.kernel.org, linux-hardening@...r.kernel.org, linux-doc@...r.kernel.org, kernel@...labora.com, gbiv@...gle.com, ryanbeltran@...gle.com, inglorion@...gle.com, ajordanr@...gle.com, jorgelo@...omium.org, "Guenter Roeck" <groeck@...omium.org>, "Doug Anderson" <dianders@...omium.org>, "Kees Cook" <keescook@...omium.org>, "Jann Horn" <jannh@...gle.com>, "Andrew Morton" <akpm@...ux-foundation.org>, "Christian Brauner" <brauner@...nel.org>, "Mike Frysinger" <vapier@...omium.org>
Subject: Re: [PATCH v4 2/2] proc: restrict /proc/pid/mem

On Saturday, May 25, 2024 08:49 EEST, Randy Dunlap <rdunlap@...radead.org> wrote:

> Hi--
> 
> On 5/24/24 12:28 PM, Adrian Ratiu wrote:
> > diff --git a/security/Kconfig b/security/Kconfig
> > index 412e76f1575d..0cd73f848b5a 100644
> > --- a/security/Kconfig
> > +++ b/security/Kconfig
> > @@ -183,6 +183,74 @@ config STATIC_USERMODEHELPER_PATH
> >  	  If you wish for all usermode helper programs to be disabled,
> >  	  specify an empty string here (i.e. "").
> >  
> > +menu "Procfs mem restriction options"
> > +
> > +config PROC_MEM_RESTRICT_FOLL_FORCE_DEFAULT
> > +	bool "Restrict all FOLL_FORCE flag usage"
> > +	default n
> > +	help
> > +	  Restrict all FOLL_FORCE usage during /proc/*/mem RW.
> > +	  Debuggerg like GDB require using FOLL_FORCE for basic
> 
> 	  Debuggers

Hello and thank you for the feedback!

I'll fix these typos in a v5 together with the kernel test robot failures.

I'll give v4 a bit more time in case other people have more feedback,
so I can address them all in one go.