linux-kernel - Re: [GIT PULL] execve updates for v6.13-rc1

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAHk-=wgv8mo=qfy6bLSdiWYFR4CPei_V6hC0_o_hDhtZS9SYPQ@mail.gmail.com>
Date: Wed, 20 Nov 2024 18:45:35 -0800
From: Linus Torvalds <torvalds@...ux-foundation.org>
To: "Eric W. Biederman" <ebiederm@...ssion.com>
Cc: Kees Cook <kees@...nel.org>, linux-kernel@...r.kernel.org, 
	Alexander Viro <viro@...iv.linux.org.uk>, 
	Christophe JAILLET <christophe.jaillet@...adoo.fr>, Dan Carpenter <dan.carpenter@...aro.org>, 
	Nir Lichtman <nir@...htman.org>, syzbot+03e1af5c332f7e0eb84b@...kaller.appspotmail.com, 
	Tycho Andersen <tandersen@...flix.com>, Vegard Nossum <vegard.nossum@...cle.com>, 
	Zbigniew Jędrzejewski-Szmek <zbyszek@...waw.pl>
Subject: Re: [GIT PULL] execve updates for v6.13-rc1

On Wed, 20 Nov 2024 at 18:23, Linus Torvalds
<torvalds@...ux-foundation.org> wrote:
>
> > Again binfmt_script still uses it.
>
> Ahh, yeah, we can't just get rid of it.

Actually, that reminds me: we've had issues with this horrible fdpath
hack before due to close-on-exec, and that's why we have
BINPRM_FLAGS_PATH_INACCESSIBLE.

And that's independent of the whole "/proc isn't always mounted", so
that the /dev/fd/%d/.. paths don't work at all.

It would probably have been much nicer if we just put the real path of
the dentry originally in ->fdpath, but I suspect it's too late to fix
now: it would _mostly_ be a more reliable and meaningful path, and it
would fix the close-on-exec situation, but I would not be surprised if
we have some horrible  user that really depends on the 'fd' being the
only way to actually access it (either due to permission issues, or
because of it having been actively unlinked).

              Linus