linux-kernel - Re: [GIT PULL] execve updates for v6.13-rc1

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAHk-=whzKjzbZQ9a-ZvRFwj6X_wsQvNjiizyCzTryEQnZc_47A@mail.gmail.com>
Date: Thu, 21 Nov 2024 09:47:03 -0800
From: Linus Torvalds <torvalds@...ux-foundation.org>
To: Zbigniew Jędrzejewski-Szmek <zbyszek@...waw.pl>
Cc: "Eric W. Biederman" <ebiederm@...ssion.com>, Kees Cook <kees@...nel.org>, linux-kernel@...r.kernel.org, 
	Alexander Viro <viro@...iv.linux.org.uk>, 
	Christophe JAILLET <christophe.jaillet@...adoo.fr>, Dan Carpenter <dan.carpenter@...aro.org>, 
	Nir Lichtman <nir@...htman.org>, syzbot+03e1af5c332f7e0eb84b@...kaller.appspotmail.com, 
	Tycho Andersen <tandersen@...flix.com>, Vegard Nossum <vegard.nossum@...cle.com>
Subject: Re: [GIT PULL] execve updates for v6.13-rc1

On Thu, 21 Nov 2024 at 09:28, Linus Torvalds
<torvalds@...ux-foundation.org> wrote:
>
> See? There is no single solution, but at least the dentry name is a
> *reliable* thing, not a random garbage thing passed in by user space.

Note that the reason I want 'comm[]' to be something actually
*reliable* is that that is what the kernel actually uses for various
error messages etc.

User space tools like 'ps' already do the "dig around in user space to
look for argv[]" thing, and tools like "ps" do *not* actually use
comm[] at all from normal user space programs.

For example, why do you think "ps 3545" says

   3545 ?        Ssl    0:00 /usr/libexec/gnome-shell-calendar-server

but when I do "cat /proc/3545/stat" I see

    3545 (gnome-shell-cal) S 3129 ...

in the output?

That's exactly because comm[] has that "gnome-shell-cal" (limited to
16 characters with the NUL due to TASK_COMM_LEN), but 'ps' will go
digging into user space argv[0] by looking at /proc/*/cmdline which
gets you much more than just the name of the executable.

And I do *not* want anybody to think that "comm[]" should act IN ANY
WAY identically to /proc/*/cmdline. It never has, and it never will.
Exactly because the two are completely different things, for different
uses.

And yes, people have historically actively messed with the argv[0]
thing, and actively tried to hide what the actual executable was.

I am not AT ALL interested in letting people play those kinds of games
with "comm[]".

There's a very real reason I rejected that original execve() change.
It was stupid and wrong.

                  Linus