[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20170614151008.42bc57a2@alans-desktop>
Date: Wed, 14 Jun 2017 15:10:08 +0100
From: Alan Cox <gnomes@...rguk.ukuu.org.uk>
To: Mimi Zohar <zohar@...ux.vnet.ibm.com>
Cc: Mickaël Salaün <mic@...ikod.net>,
Tetsuo Handa
<penguin-kernel@...ove.SAKURA.ne.jp>,
keescook@...omium.org, matt@...tt.com, jason@...finion.com,
linux-security-module@...r.kernel.org,
Daniel Micay <danielmicay@...il.com>,
kernel-hardening
<kernel-hardening@...ts.openwall.com>,
LKML <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH v1] shebang: restrict python interactive
prompt/interpreter
On Mon, 12 Jun 2017 10:27:24 -0400
Mimi Zohar <zohar@...ux.vnet.ibm.com> wrote:
> On Sun, 2017-06-11 at 22:32 -0400, Mimi Zohar wrote:
> > On Sun, 2017-06-11 at 13:44 +0200, Mickaël Salaün wrote:
>
> > > Using filesystem xattr seems like a good idea for this kind of
> > > exceptions and instead of a hardcoded interpreter path. Something like
> > > "security.tpe.interpreter=1|2" (bitmask for interpreter-only and/or CLI)
> > > and "security.tpe.environment=HOME,LOGNAME" would be quite flexible to
> > > configure a security policy for some binaries. This could also be
> > > protected by IMA/EVM, if needed.
> >
> > Checking for the existence of an xattr without caching is relatively
> > slow. I'm not sure that we would want to go this route.
>
> For identifying interpreters, xattrs would be too slow (without
> caching results), but once identified, using xattrs as you suggested,
> for specifying how interpreters can be invoked and limiting
> environment variables, is a good idea. Perhaps the two xattrs could
> be combined?
It's not just #! you need to cover. If I can run ld.so for my arch format
then ld.so will helpfully let me load any ELF binary I like and run it.
Alan
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
