[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 7 May 2020 09:00:16 +0000
From: David Laight <David.Laight@...LAB.COM>
To: 'Mickaël Salaün' <mic@...ikod.net>,
"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
CC: Aleksa Sarai <cyphar@...har.com>, Alexei Starovoitov <ast@...nel.org>, "Al
Viro" <viro@...iv.linux.org.uk>, Andy Lutomirski <luto@...nel.org>,
"Christian Heimes" <christian@...hon.org>, Daniel Borkmann
<daniel@...earbox.net>, "Deven Bowers" <deven.desai@...ux.microsoft.com>,
Eric Chiang <ericchiang@...gle.com>, Florian Weimer <fweimer@...hat.com>,
James Morris <jmorris@...ei.org>, Jan Kara <jack@...e.cz>, Jann Horn
<jannh@...gle.com>, Jonathan Corbet <corbet@....net>, Kees Cook
<keescook@...omium.org>, "Lakshmi Ramasubramanian"
<nramas@...ux.microsoft.com>, Matthew Garrett <mjg59@...gle.com>, Matthew
Wilcox <willy@...radead.org>, Michael Kerrisk <mtk.manpages@...il.com>,
Mickaël Salaün <mickael.salaun@....gouv.fr>, Mimi Zohar
<zohar@...ux.ibm.com>, Philippe Trébuchet
<philippe.trebuchet@....gouv.fr>, Scott Shell <scottsh@...rosoft.com>, Sean
Christopherson <sean.j.christopherson@...el.com>, Shuah Khan
<shuah@...nel.org>, Steve Dower <steve.dower@...hon.org>, Steve Grubb
<sgrubb@...hat.com>, Thibaut Sautereau <thibaut.sautereau@....gouv.fr>,
Vincent Strubel <vincent.strubel@....gouv.fr>,
"kernel-hardening@...ts.openwall.com" <kernel-hardening@...ts.openwall.com>,
"linux-api@...r.kernel.org" <linux-api@...r.kernel.org>,
"linux-integrity@...r.kernel.org" <linux-integrity@...r.kernel.org>,
"linux-security-module@...r.kernel.org"
<linux-security-module@...r.kernel.org>, "linux-fsdevel@...r.kernel.org"
<linux-fsdevel@...r.kernel.org>
Subject: RE: [PATCH v5 0/6] Add support for O_MAYEXEC
From: Mickaël Salaün
> Sent: 07 May 2020 09:37
...
> > None of that description actually says what the patch actually does.
>
> "Add support for O_MAYEXEC" "to enable to control script execution".
> What is not clear here? This seems well understood by other commenters.
> The documentation patch and the talks can also help.
I'm guessing that passing O_MAYEXEC to open() requests the kernel
check for execute 'x' permissions (as well as read).
Then kernel policy determines whether 'read' access is actually enough,
or whether 'x' access (possibly masked by mount permissions) is needed.
If that is true, two lines say what is does.
Have you ever set a shell script permissions to --x--s--x ?
Ends up being executable by everyone except the owner!
Having the kernel pass all '#!' files to their interpreters
through an open fd might help security.
In that case the user doesn't need read access to the file
in order to get an interpreter to process it.
(You'd need to stop strace showing the contents to actually
hide them.)
David
-
Registered Address Lakeside, Bramley Road, Mount Farm, Milton Keynes, MK1 1PT, UK
Registration No: 1397386 (Wales)
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
