kernel-hardening - Re: [PATCH v2 0/5] Add support for O

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Fri, 06 Sep 2019 20:57:00 +0200
From: Florian Weimer <fweimer@...hat.com>
To: Steve Grubb <sgrubb@...hat.com>
Cc: Mickaël Salaün <mic@...ikod.net>,
  linux-kernel@...r.kernel.org,  Aleksa
 Sarai <cyphar@...har.com>,  Alexei Starovoitov <ast@...nel.org>,  Al Viro
 <viro@...iv.linux.org.uk>,  Andy Lutomirski <luto@...nel.org>,  Christian
 Heimes <christian@...hon.org>,  Daniel Borkmann <daniel@...earbox.net>,
  Eric Chiang <ericchiang@...gle.com>,  James Morris <jmorris@...ei.org>,
  Jan Kara <jack@...e.cz>,  Jann Horn <jannh@...gle.com>,  Jonathan Corbet
 <corbet@....net>,  Kees Cook <keescook@...omium.org>,  Matthew Garrett
 <mjg59@...gle.com>,  Matthew Wilcox <willy@...radead.org>,  Michael
 Kerrisk <mtk.manpages@...il.com>,  Mickaël Salaün
 <mickael.salaun@....gouv.fr>,  Mimi Zohar <zohar@...ux.ibm.com>,  Philippe
 Trébuchet <philippe.trebuchet@....gouv.fr>,  Scott Shell
 <scottsh@...rosoft.com>,  Sean Christopherson
 <sean.j.christopherson@...el.com>,  Shuah Khan <shuah@...nel.org>,  Song
 Liu <songliubraving@...com>,  Steve Dower <steve.dower@...hon.org>,
  Thibaut Sautereau <thibaut.sautereau@....gouv.fr>,  Vincent Strubel
 <vincent.strubel@....gouv.fr>,  Yves-Alexis Perez
 <yves-alexis.perez@....gouv.fr>,  kernel-hardening@...ts.openwall.com,
  linux-api@...r.kernel.org,  linux-security-module@...r.kernel.org,
  linux-fsdevel@...r.kernel.org
Subject: Re: [PATCH v2 0/5] Add support for O_MAYEXEC

* Steve Grubb:

> Now with LD_AUDIT
> $ LD_AUDIT=/home/sgrubb/test/openflags/strip-flags.so.0 strace ./test 2>&1 | grep passwd
> openat(3, "passwd", O_RDONLY)           = 4
>
> No O_CLOEXEC flag.

I think you need to explain in detail why you consider this a problem.

With LD_PRELOAD and LD_AUDIT, you can already do anything, including
scanning other loaded objects for a system call instruction and jumping
to that (in case a security module in the kernel performs a PC check to
confer additional privileges).

Thanks,
Florian

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.