netdev - Re: [RFC v2 00/10] snet: Security for NETwork syscalls

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <m2vdd9p9r7.fsf@ssh.synack.fr>
Date:	Sat, 06 Mar 2010 19:47:56 +0100
From:	Samir Bellabes <sam@...ack.fr>
To:	Tetsuo Handa <penguin-kernel@...ove.SAKURA.ne.jp>
Cc:	linux-kernel@...r.kernel.org, netdev@...r.kernel.org,
	netfilter-devel@...r.kernel.org, hadi@...erus.ca, kaber@...sh.net,
	zbr@...emap.net, nhorman@...driver.com, root@...aldomain.pl,
	linux-security-module@...r.kernel.org
Subject: Re: [RFC v2 00/10] snet: Security for NETwork syscalls

Tetsuo Handa <penguin-kernel@...ove.SAKURA.ne.jp> writes:

> Regarding [RFC v2 09/10] snet: introduce snet_ticket
> +enum snet_verdict snet_ticket_check(struct snet_info *info)
> +{
> +       struct snet_ticket *st = NULL;
> +       unsigned int h = 0, verdict = SNET_VERDICT_NONE;
> +       struct list_head *l = NULL;
> +       struct snet_task_security *tsec = NULL;
> +
> +       if (snet_ticket_mode == SNET_TICKET_OFF)
> +               goto out;
> +
> +       tsec = (struct snet_task_security*) current_security();
> +
> +       h = jhash_2words(info->syscall, info->protocol, 0) % HSIZE;
> +       l = &tsec->hash[h];
> +
> +       read_lock_bh(&tsec->lock);
>
> Credentials are allocated for copy-on-write basis.
> Sharing "tsec" among multiple "struct task_struct" is what you intended?

No, there is no shared "tsec".
snet_ticket_check() is called from the process context. So "tsec" is
a pointer to the "void *security" pointer from its own "struct
task_struct".

every task_struct have a "tsec" allocated to its "void *security"
pointer. 

I will take a second look on how to access the credentials COW.

> Regards.

Tetsuo, thank you again for reviewing.
sam
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html