[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <ee1ae815b6e75021709612181a6a4415fda543a4.camel@HansenPartnership.com>
Date: Tue, 16 Jul 2024 12:12:49 -0400
From: James Bottomley <James.Bottomley@...senPartnership.com>
To: Roberto Sassu <roberto.sassu@...weicloud.com>,
Mickaël Salaün
<mic@...ikod.net>, Mimi Zohar <zohar@...ux.ibm.com>
Cc: Al Viro <viro@...iv.linux.org.uk>, Christian Brauner
<brauner@...nel.org>, Kees Cook <keescook@...omium.org>, Linus Torvalds
<torvalds@...ux-foundation.org>, Paul Moore <paul@...l-moore.com>, Theodore
Ts'o <tytso@....edu>, Alejandro Colomar <alx@...nel.org>, Aleksa Sarai
<cyphar@...har.com>, Andrew Morton <akpm@...ux-foundation.org>, Andy
Lutomirski <luto@...nel.org>, Arnd Bergmann <arnd@...db.de>, Casey
Schaufler <casey@...aufler-ca.com>, Christian Heimes
<christian@...hon.org>, Dmitry Vyukov <dvyukov@...gle.com>, Eric Biggers
<ebiggers@...nel.org>, Eric Chiang <ericchiang@...gle.com>, Fan Wu
<wufan@...ux.microsoft.com>, Florian Weimer <fweimer@...hat.com>, Geert
Uytterhoeven <geert@...ux-m68k.org>, James Morris
<jamorris@...ux.microsoft.com>, Jan Kara <jack@...e.cz>, Jann Horn
<jannh@...gle.com>, Jeff Xu <jeffxu@...gle.com>, Jonathan Corbet
<corbet@....net>, Jordan R Abrahams <ajordanr@...gle.com>, Lakshmi
Ramasubramanian <nramas@...ux.microsoft.com>, Luca Boccassi
<bluca@...ian.org>, Luis Chamberlain <mcgrof@...nel.org>, "Madhavan T .
Venkataraman" <madvenka@...ux.microsoft.com>, Matt Bobrowski
<mattbobrowski@...gle.com>, Matthew Garrett <mjg59@...f.ucam.org>, Matthew
Wilcox <willy@...radead.org>, Miklos Szeredi <mszeredi@...hat.com>, Nicolas
Bouchinet <nicolas.bouchinet@....gouv.fr>, Scott Shell
<scottsh@...rosoft.com>, Shuah Khan <shuah@...nel.org>, Stephen Rothwell
<sfr@...b.auug.org.au>, Steve Dower <steve.dower@...hon.org>, Steve Grubb
<sgrubb@...hat.com>, Thibaut Sautereau <thibaut.sautereau@....gouv.fr>,
Vincent Strubel <vincent.strubel@....gouv.fr>, Xiaoming Ni
<nixiaoming@...wei.com>, Yin Fengwei <fengwei.yin@...el.com>,
kernel-hardening@...ts.openwall.com, linux-api@...r.kernel.org,
linux-fsdevel@...r.kernel.org, linux-integrity@...r.kernel.org,
linux-kernel@...r.kernel.org, linux-security-module@...r.kernel.org
Subject: Re: [RFC PATCH v19 0/5] Script execution control (was O_MAYEXEC)
On Tue, 2024-07-16 at 17:57 +0200, Roberto Sassu wrote:
> But the Clip OS 4 patch does not cover the redirection case:
>
> # ./bash < /root/test.sh
> Hello World
>
> Do you have a more recent patch for that?
How far down the rabbit hole do you want to go? You can't forbid a
shell from executing commands from stdin because logging in then won't
work. It may be possible to allow from a tty backed file and not from
a file backed one, but you still have the problem of the attacker
manually typing in the script.
The saving grace for this for shells is that they pretty much do
nothing on their own (unlike python) so you can still measure all the
executables they call out to, which provides reasonable safety.
James
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
