[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Wed, 29 Jun 2011 15:20:45 +0400
From: Vasiliy Kulikov <segoon@...nwall.com>
To: Balbir Singh <bsingharora@...il.com>
Cc: KOSAKI Motohiro <kosaki.motohiro@...fujitsu.com>,
linux-kernel@...r.kernel.org, balbir@...ux.vnet.ibm.com,
akpm@...ux-foundation.org, viro@...iv.linux.org.uk,
rientjes@...gle.com, wilsons@...rt.ca, security@...nel.org,
eparis@...hat.com, kernel-hardening@...ts.openwall.com,
Linus Torvalds <torvalds@...ux-foundation.org>
Subject: Re: [PATCH 1/2] proc: restrict access to /proc/PID/io
On Wed, Jun 29, 2011 at 06:46 +0530, Balbir Singh wrote:
> On Tue, Jun 28, 2011 at 1:20 PM, Vasiliy Kulikov <segoon@...nwall.com> wrote:
> > On Tue, Jun 28, 2011 at 06:54 +0530, Balbir Singh wrote:
> >> > As to rounding - this is a workaround, not a fix. What if some program
> >> > reads one byte from tty and then do some io activity exactly of 1kb-1?
> >> > Then you just measure kbs and get original tty activity. (just a crazy
> >> > example to show that it is not a full solution.)
> >> >
> >>
> >> That would happen with a probability of 1/1024
> >
> > I'd not claim about probability here, but anyway rounding would be not
> > a fix, just a workaround. Also note that the random value is program
> > dependent, it is not chosen at the program start time or anything
> > similar. IOW, if the program is vulnerable, it is vulnerable with 100%
> > probability.
> >
>
> I was thinking along ASLR lines, ASLR reduces the probability of
> malware finding specific address in code, but does not eliminate it
> completely.
You confuse a bug fix with a prevention of an exploitation technique
here. ASLR doesn't fix anything, it tries to break exploits that use
bugs like arbitrary writes/reads. If there is arbitrary write bug,
almost always the game is over; that's why such probabilistic measure is
acceptable. On the contrary, /proc/*/io leak is a bug, which is fairly
fixable by restricting an access (breaking programs, though). So, from
the security point of view these cases are not comparable.
> In the worst case as you suggest may
> be the statistics would be available only to root, but that is the
> final drop down scenario.
Yes, it breaks iotop, but it is a full solution.
> No we don't clear taskstats info on credential changes.
If taskstats info is allowed to travel through credential changes, it
exposes the similar private information.
Thanks,
--
Vasiliy Kulikov
http://www.openwall.com - bringing security into open computing environments
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
