|
Message-ID: <20110629112045.GA29011@albatros> Date: Wed, 29 Jun 2011 15:20:45 +0400 From: Vasiliy Kulikov <segoon@...nwall.com> To: Balbir Singh <bsingharora@...il.com> Cc: KOSAKI Motohiro <kosaki.motohiro@...fujitsu.com>, linux-kernel@...r.kernel.org, balbir@...ux.vnet.ibm.com, akpm@...ux-foundation.org, viro@...iv.linux.org.uk, rientjes@...gle.com, wilsons@...rt.ca, security@...nel.org, eparis@...hat.com, kernel-hardening@...ts.openwall.com, Linus Torvalds <torvalds@...ux-foundation.org> Subject: Re: [PATCH 1/2] proc: restrict access to /proc/PID/io On Wed, Jun 29, 2011 at 06:46 +0530, Balbir Singh wrote: > On Tue, Jun 28, 2011 at 1:20 PM, Vasiliy Kulikov <segoon@...nwall.com> wrote: > > On Tue, Jun 28, 2011 at 06:54 +0530, Balbir Singh wrote: > >> > As to rounding - this is a workaround, not a fix. What if some program > >> > reads one byte from tty and then do some io activity exactly of 1kb-1? > >> > Then you just measure kbs and get original tty activity. (just a crazy > >> > example to show that it is not a full solution.) > >> > > >> > >> That would happen with a probability of 1/1024 > > > > I'd not claim about probability here, but anyway rounding would be not > > a fix, just a workaround. Also note that the random value is program > > dependent, it is not chosen at the program start time or anything > > similar. IOW, if the program is vulnerable, it is vulnerable with 100% > > probability. > > > > I was thinking along ASLR lines, ASLR reduces the probability of > malware finding specific address in code, but does not eliminate it > completely. You confuse a bug fix with a prevention of an exploitation technique here. ASLR doesn't fix anything, it tries to break exploits that use bugs like arbitrary writes/reads. If there is arbitrary write bug, almost always the game is over; that's why such probabilistic measure is acceptable. On the contrary, /proc/*/io leak is a bug, which is fairly fixable by restricting an access (breaking programs, though). So, from the security point of view these cases are not comparable. > In the worst case as you suggest may > be the statistics would be available only to root, but that is the > final drop down scenario. Yes, it breaks iotop, but it is a full solution. > No we don't clear taskstats info on credential changes. If taskstats info is allowed to travel through credential changes, it exposes the similar private information. Thanks, -- Vasiliy Kulikov http://www.openwall.com - bringing security into open computing environments
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.