netdev - Re: [PATCH] net: Remove a noisy printk

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <alpine.DEB.2.00.0812141745550.2447@blackhole.kfki.hu>
Date:	Sun, 14 Dec 2008 18:09:17 +0100 (CET)
From:	Jozsef Kadlecsik <kadlec@...ckhole.kfki.hu>
To:	Jan Engelhardt <jengelh@...ozas.de>
cc:	David Miller <davem@...emloft.net>, ajax@...hat.com,
	linux-kernel@...r.kernel.org, davej@...hat.com,
	netdev@...r.kernel.org, netfilter-devel@...r.kernel.org,
	Patrick McHardy <kaber@...sh.net>
Subject: Re: [PATCH] net: Remove a noisy printk

On Sat, 13 Dec 2008, Jan Engelhardt wrote:

> On Friday 2008-12-12 05:32, David Miller wrote:
> >From: Adam Jackson <ajax@...hat.com>
> >Date: Thu, 11 Dec 2008 17:13:42 -0500
> >
> >> From: Dave Jones <davej@...hat.com>
> >> 
> >> These messages are trivial to trigger when running stress tests
> >> like isic, and add no real value.
> >> 
> >> Signed-off-by: Dave Jones <davej@...hat.com>
> >> Signed-off-by: Adam Jackson <ajax@...hat.com>
> >
> >If you don't send this to the netfilter developers nor the networking
> >developers, noboby knowledgable can even look at this patch.
> 
> (For the archive, it's not the Internation Student Identity Card)
> http://www.packetfactory.net/Projects/ISIC/ :
> 
> ?ISIC is a suite of utilities to exercise the stability of an IP
> Stack and its component stacks (TCP, UDP, ICMP et. al.) It generates
> piles of pseudo random packets of the target protocol.?
> 
> >> @@ -147,8 +147,6 @@ static unsigned int ipv4_conntrack_local(unsigned int hooknum,
> >>  	/* root is playing with raw sockets. */
> >>  	if (skb->len < sizeof(struct iphdr) ||
> >>  	    ip_hdrlen(skb) < sizeof(struct iphdr)) {
> >> -		if (net_ratelimit())
> >> -			printk("ipt_hook: happy cracking.\n");
> >>  		return NF_ACCEPT;
> >>  	}
> >>  	return nf_conntrack_in(dev_net(out), PF_INET, hooknum, skb);
> 
> I think this change is ok.

In a >normal< system one usually does not use raw sockets. So if a root 
process do use raw socket, at least netfilter sends a notification and 
there's a chance that someone take notice it by checking the kernel logs.

Yes, if the machine is compromized then the logs can be tampered, if 
netfilter is compiled as a module, the module can be replaced by another 
one, and so on. A careful cracker can take care of all the alarms, trip 
wires. But should we remove them due to nuisances on >test< systems?

Rather make it a kernel compile option but do not remove.

Best regards,
Jozsef
-
E-mail  : kadlec@...ckhole.kfki.hu, kadlec@...l.kfki.hu
PGP key : http://www.kfki.hu/~kadlec/pgp_public_key.txt
Address : KFKI Research Institute for Particle and Nuclear Physics
          H-1525 Budapest 114, POB. 49, Hungary
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html