[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 2 Jun 2017 08:56:13 +1000 (AEST)
From: James Morris <jmorris@...ei.org>
To: Kees Cook <keescook@...omium.org>
cc: lazytyped <lazytyped@...il.com>,
"kernel-hardening@...ts.openwall.com" <kernel-hardening@...ts.openwall.com>
Subject: Re: Re: [PATCH v7 2/2] security: tty: make TIOCSTI
ioctl require CAP_SYS_ADMIN
On Thu, 1 Jun 2017, Kees Cook wrote:
> All of the reasoning here seems to match the link restrictions from 5
> years ago: a crappy API (sticky bit) is not handled by userspace (open
> /tmp/$$!) and people get attacked. The solution was a sysctl to enable
> the link restrictions that killed the entire class of the common
> attack (though it didn't solve especially egregious bad uses, much
This is the problem -- it doesn't really eliminate the underlying issue.
A better solution (in this case) was to implement a new API which
addresses the issue at an architectural level, i.e. namespace-based
private /tmp views, and encourage its adoption.
> like the TIOCSTI fix). Every distro enabled the sysctl, and, while the
> data is noisy, looking a CVEs matching "/tmp symlink", the numbers
> drop from 2013 and later (with none yet for 2017).
I wonder how much of this is due to the sysctl vs. adoption of private
/tmp, and what may be lurking in the "egregious bad uses" category for
future CVEs. And obviously we don't know what various folk may have up
their sleeves, if anything.
--
James Morris
<jmorris@...ei.org>
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
