linux-kernel - Re: [RFC PATCH v19 0/5] Script execution control (was O

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <ee1ae815b6e75021709612181a6a4415fda543a4.camel@HansenPartnership.com>
Date: Tue, 16 Jul 2024 12:12:49 -0400
From: James Bottomley <James.Bottomley@...senPartnership.com>
To: Roberto Sassu <roberto.sassu@...weicloud.com>, 
	Mickaël Salaün
	 <mic@...ikod.net>, Mimi Zohar <zohar@...ux.ibm.com>
Cc: Al Viro <viro@...iv.linux.org.uk>, Christian Brauner
 <brauner@...nel.org>,  Kees Cook <keescook@...omium.org>, Linus Torvalds
 <torvalds@...ux-foundation.org>, Paul Moore <paul@...l-moore.com>, Theodore
 Ts'o <tytso@....edu>, Alejandro Colomar <alx@...nel.org>, Aleksa Sarai
 <cyphar@...har.com>, Andrew Morton <akpm@...ux-foundation.org>, Andy
 Lutomirski <luto@...nel.org>, Arnd Bergmann <arnd@...db.de>, Casey
 Schaufler <casey@...aufler-ca.com>, Christian Heimes
 <christian@...hon.org>, Dmitry Vyukov <dvyukov@...gle.com>, Eric Biggers
 <ebiggers@...nel.org>, Eric Chiang <ericchiang@...gle.com>, Fan Wu
 <wufan@...ux.microsoft.com>, Florian Weimer <fweimer@...hat.com>, Geert
 Uytterhoeven <geert@...ux-m68k.org>, James Morris
 <jamorris@...ux.microsoft.com>, Jan Kara <jack@...e.cz>,  Jann Horn
 <jannh@...gle.com>, Jeff Xu <jeffxu@...gle.com>, Jonathan Corbet
 <corbet@....net>, Jordan R Abrahams <ajordanr@...gle.com>, Lakshmi
 Ramasubramanian <nramas@...ux.microsoft.com>, Luca Boccassi
 <bluca@...ian.org>, Luis Chamberlain <mcgrof@...nel.org>, "Madhavan T .
 Venkataraman" <madvenka@...ux.microsoft.com>, Matt Bobrowski
 <mattbobrowski@...gle.com>, Matthew Garrett <mjg59@...f.ucam.org>, Matthew
 Wilcox <willy@...radead.org>, Miklos Szeredi <mszeredi@...hat.com>, Nicolas
 Bouchinet <nicolas.bouchinet@....gouv.fr>,  Scott Shell
 <scottsh@...rosoft.com>, Shuah Khan <shuah@...nel.org>, Stephen Rothwell
 <sfr@...b.auug.org.au>,  Steve Dower <steve.dower@...hon.org>, Steve Grubb
 <sgrubb@...hat.com>, Thibaut Sautereau <thibaut.sautereau@....gouv.fr>,
 Vincent Strubel <vincent.strubel@....gouv.fr>,  Xiaoming Ni
 <nixiaoming@...wei.com>, Yin Fengwei <fengwei.yin@...el.com>, 
 kernel-hardening@...ts.openwall.com, linux-api@...r.kernel.org, 
 linux-fsdevel@...r.kernel.org, linux-integrity@...r.kernel.org, 
 linux-kernel@...r.kernel.org, linux-security-module@...r.kernel.org
Subject: Re: [RFC PATCH v19 0/5] Script execution control (was O_MAYEXEC)

On Tue, 2024-07-16 at 17:57 +0200, Roberto Sassu wrote:
> But the Clip OS 4 patch does not cover the redirection case:
> 
> # ./bash < /root/test.sh
> Hello World
> 
> Do you have a more recent patch for that?

How far down the rabbit hole do you want to go?  You can't forbid a
shell from executing commands from stdin because logging in then won't
work.  It may be possible to allow from a tty backed file and not from
a file backed one, but you still have the problem of the attacker
manually typing in the script.

The saving grace for this for shells is that they pretty much do
nothing on their own (unlike python) so you can still measure all the
executables they call out to, which provides reasonable safety.

James