linux-kernel - Re: [GIT PULL] execve updates for v6.13-rc1

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAHk-=wiJZDxO+Wgmg8f=Cio9AgmJ85V7do4kxroKejHNsS80hQ@mail.gmail.com>
Date: Thu, 21 Nov 2024 09:28:09 -0800
From: Linus Torvalds <torvalds@...ux-foundation.org>
To: Zbigniew Jędrzejewski-Szmek <zbyszek@...waw.pl>
Cc: "Eric W. Biederman" <ebiederm@...ssion.com>, Kees Cook <kees@...nel.org>, linux-kernel@...r.kernel.org, 
	Alexander Viro <viro@...iv.linux.org.uk>, 
	Christophe JAILLET <christophe.jaillet@...adoo.fr>, Dan Carpenter <dan.carpenter@...aro.org>, 
	Nir Lichtman <nir@...htman.org>, syzbot+03e1af5c332f7e0eb84b@...kaller.appspotmail.com, 
	Tycho Andersen <tandersen@...flix.com>, Vegard Nossum <vegard.nossum@...cle.com>
Subject: Re: [GIT PULL] execve updates for v6.13-rc1

On Thu, 21 Nov 2024 at 09:22, Zbigniew Jędrzejewski-Szmek
<zbyszek@...waw.pl> wrote:
>
> It'll "break userspace" in the sense the the resulting program name
> visible in /proc/self/{comm,stat,status} would be different than the
> expected value. Currently userspace is not using fexecve because this
> string is "just garbage". We'd very much like to start using fexecve,
> but we cannot do this (in the general case) if that'll result in a
> changed program name. If we change the value from the current
> (garbage) value to something that doesn't provide identical behaviour
> between execve and fexecve, fexecve will unused.

Well, then you had better not use fexecve(), because that "identical
behavior" is fundamentally impossible.

The thing is, "argv[0]" can - and will be - complete garbage. Yes,
it's *often* the same as the filename, but there is actually zero
guarantee of that. It can be any random thing - it's literally just a
user space argument.

And the dentry name *will* be the name of the underlying executable.
Again, it is *often* the same as the filename, but symlinks have
already been brought up as an example when it isn't.

See? There is no single solution, but at least the dentry name is a
*reliable* thing, not a random garbage thing passed in by user space.

End result: if you don't like it, don't use fexecve(). It really is that simple.

               Linus