linux-kernel - Re: [RFC PATCH v1 0/2] Add O_DENY_WRITE (complement AT_EXECVE

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250826123041.GB1603531@mit.edu>
Date: Tue, 26 Aug 2025 08:30:41 -0400
From: "Theodore Ts'o" <tytso@....edu>
To: Mickaël Salaün <mic@...ikod.net>
Cc: Christian Brauner <brauner@...nel.org>, Al Viro <viro@...iv.linux.org.uk>,
        Kees Cook <keescook@...omium.org>, Paul Moore <paul@...l-moore.com>,
        Serge Hallyn <serge@...lyn.com>, Andy Lutomirski <luto@...nel.org>,
        Arnd Bergmann <arnd@...db.de>, Christian Heimes <christian@...hon.org>,
        Dmitry Vyukov <dvyukov@...gle.com>, Elliott Hughes <enh@...gle.com>,
        Fan Wu <wufan@...ux.microsoft.com>,
        Florian Weimer <fweimer@...hat.com>, Jann Horn <jannh@...gle.com>,
        Jeff Xu <jeffxu@...gle.com>, Jonathan Corbet <corbet@....net>,
        Jordan R Abrahams <ajordanr@...gle.com>,
        Lakshmi Ramasubramanian <nramas@...ux.microsoft.com>,
        Luca Boccassi <bluca@...ian.org>,
        Matt Bobrowski <mattbobrowski@...gle.com>,
        Miklos Szeredi <mszeredi@...hat.com>, Mimi Zohar <zohar@...ux.ibm.com>,
        Nicolas Bouchinet <nicolas.bouchinet@....cyber.gouv.fr>,
        Robert Waite <rowait@...rosoft.com>,
        Roberto Sassu <roberto.sassu@...wei.com>,
        Scott Shell <scottsh@...rosoft.com>,
        Steve Dower <steve.dower@...hon.org>, Steve Grubb <sgrubb@...hat.com>,
        kernel-hardening@...ts.openwall.com, linux-api@...r.kernel.org,
        linux-fsdevel@...r.kernel.org, linux-integrity@...r.kernel.org,
        linux-kernel@...r.kernel.org, linux-security-module@...r.kernel.org
Subject: Re: [RFC PATCH v1 0/2] Add O_DENY_WRITE (complement AT_EXECVE_CHECK)

Is there a single, unified design and requirements document that
describes the threat model, and what you are trying to achieve with
AT_EXECVE_CHECK and O_DENY_WRITE?  I've been looking at the cover
letters for AT_EXECVE_CHECK and O_DENY_WRITE, and the documentation
that has landed for AT_EXECVE_CHECK and it really doesn't describe
what *are* the checks that AT_EXECVE_CHECK is trying to achieve:

   "The AT_EXECVE_CHECK execveat(2) flag, and the
   SECBIT_EXEC_RESTRICT_FILE and SECBIT_EXEC_DENY_INTERACTIVE
   securebits are intended for script interpreters and dynamic linkers
   to enforce a consistent execution security policy handled by the
   kernel."

Um, what security policy?  What checks?  What is a sample exploit
which is blocked by AT_EXECVE_CHECK?

And then on top of it, why can't you do these checks by modifying the
script interpreters?

Confused,

						- Ted