Re: [PATCH 1/2] procfs: restore 0400 permissions on /proc/*/{syscall,stack,personality}

On 04/10/13 10:41, Kees Cook wrote: > On Wed, Aug 28, 2013 at 1:49 PM, Kees Cook wrote: > > BTW, this just came to my attention: > http://marc.info/?l=linux-kernel&m=138049414321387&w=2 > > Same problem, just for /proc/kallsyms. This would benefit from the > open vs read cred check as well, I

Re: [PATCH 1/2] procfs: restore 0400 permissions on /proc/*/{syscall,stack,personality}

On Wed, Aug 28, 2013 at 1:49 PM, Kees Cook wrote: > On Wed, Aug 28, 2013 at 1:11 PM, Djalal Harouni wrote: >> Cc'ed more people, >> >> On Tue, Aug 27, 2013 at 06:24:06PM +0100, Djalal Harouni wrote: >>> Hi Al, >>> >>> On Mon, Aug 26, 2013 at 06:20:55PM +0100, Al Viro wrote: >>> > On Mon, Aug 26,

Re: [PATCH 1/2] procfs: restore 0400 permissions on /proc/*/{syscall,stack,personality}

Hi Eric, (Sorry for the delay, please see below) On Sat, Aug 31, 2013 at 06:44:39PM -0700, Eric W. Biederman wrote: > Djalal Harouni writes: [...] > > Yes Kees, > > > > I did try a year ago to adapt the exec_id from grsecurity and failed > > (and failed again to resend - not enough resources):

Re: [PATCH 1/2] procfs: restore 0400 permissions on /proc/*/{syscall,stack,personality}

On Sat, Aug 31, 2013 at 6:44 PM, Eric W. Biederman wrote: > Djalal Harouni writes: > >> (Sorry for my late response) >> >> On Thu, Aug 29, 2013 at 03:14:32PM -0700, Kees Cook wrote: >>> On Thu, Aug 29, 2013 at 2:11 AM, Djalal Harouni wrote: >>> > Hi Eric, >>> > >>> > On Wed, Aug 28, 2013 at 05:2

Re: [PATCH 1/2] procfs: restore 0400 permissions on /proc/*/{syscall,stack,personality}

Djalal Harouni writes: > (Sorry for my late response) > > On Thu, Aug 29, 2013 at 03:14:32PM -0700, Kees Cook wrote: >> On Thu, Aug 29, 2013 at 2:11 AM, Djalal Harouni wrote: >> > Hi Eric, >> > >> > On Wed, Aug 28, 2013 at 05:26:56PM -0700, Eric W. Biederman wrote: >> >> >> >> I have take a mome

Re: [PATCH 1/2] procfs: restore 0400 permissions on /proc/*/{syscall,stack,personality}

(Sorry for my late response) On Thu, Aug 29, 2013 at 03:14:32PM -0700, Kees Cook wrote: > On Thu, Aug 29, 2013 at 2:11 AM, Djalal Harouni wrote: > > Hi Eric, > > > > On Wed, Aug 28, 2013 at 05:26:56PM -0700, Eric W. Biederman wrote: > >> > >> I have take a moment and read this thread, and have be

Re: [PATCH 1/2] procfs: restore 0400 permissions on /proc/*/{syscall,stack,personality}

On Thu, Aug 29, 2013 at 2:11 AM, Djalal Harouni wrote: > Hi Eric, > > On Wed, Aug 28, 2013 at 05:26:56PM -0700, Eric W. Biederman wrote: >> >> I have take a moment and read this thread, and have been completely >> unenlightend. People are upset but it is totally unclear why. >> >> There is no exp

Re: [PATCH 1/2] procfs: restore 0400 permissions on /proc/*/{syscall,stack,personality}

Hi Eric, On Wed, Aug 28, 2013 at 05:26:56PM -0700, Eric W. Biederman wrote: > > I have take a moment and read this thread, and have been completely > unenlightend. People are upset but it is totally unclear why. > > There is no explanation why it is ok to ignore the suid-exec case, as > the pos

Re: [PATCH 1/2] procfs: restore 0400 permissions on /proc/*/{syscall,stack,personality}

Kees Cook writes: > On Wed, Aug 28, 2013 at 6:08 PM, Eric W. Biederman > wrote: >> Kees Cook writes: >> >>> On Wed, Aug 28, 2013 at 5:26 PM, Eric W. Biederman >>> wrote: Can someome please state what they are worried about in simple language step by step? [...] The closest

Re: [PATCH 1/2] procfs: restore 0400 permissions on /proc/*/{syscall,stack,personality}

On Wed, Aug 28, 2013 at 6:08 PM, Eric W. Biederman wrote: > Kees Cook writes: > >> On Wed, Aug 28, 2013 at 5:26 PM, Eric W. Biederman >> wrote: >>> Can someome please state what they are worried about in simple language >>> step by step? >>> [...] >>> The closest I saw in the thread was people w

Re: [PATCH 1/2] procfs: restore 0400 permissions on /proc/*/{syscall,stack,personality}

Kees Cook writes: > On Wed, Aug 28, 2013 at 5:26 PM, Eric W. Biederman > wrote: >> Can someome please state what they are worried about in simple language >> step by step? >> [...] >> The closest I saw in the thread was people were worried about ASLR being >> defeated. All I see are kernel addr

Re: [PATCH 1/2] procfs: restore 0400 permissions on /proc/*/{syscall,stack,personality}

On Wed, Aug 28, 2013 at 5:26 PM, Eric W. Biederman wrote: > Can someome please state what they are worried about in simple language > step by step? > [...] > The closest I saw in the thread was people were worried about ASLR being > defeated. All I see are kernel addresses and we don't have much

Re: [PATCH 1/2] procfs: restore 0400 permissions on /proc/*/{syscall,stack,personality}

I have take a moment and read this thread, and have been completely unenlightend. People are upset but it is totally unclear why. There is no explanation why it is ok to ignore the suid-exec case, as the posted patches do. Which ultimately means the patches provide little to no security benefit

Re: [PATCH 1/2] procfs: restore 0400 permissions on /proc/*/{syscall,stack,personality}

On Wed, Aug 28, 2013 at 01:49:06PM -0700, Kees Cook wrote: > On Wed, Aug 28, 2013 at 1:11 PM, Djalal Harouni wrote: [...] > >> 2) > >> The commit log says also: > >> "if you open a file before the target does suid-root exec, you'll be still > >> able to access it." so you do the task is tracable c

Re: [PATCH 1/2] procfs: restore 0400 permissions on /proc/*/{syscall,stack,personality}

On Wed, Aug 28, 2013 at 1:11 PM, Djalal Harouni wrote: > Cc'ed more people, > > On Tue, Aug 27, 2013 at 06:24:06PM +0100, Djalal Harouni wrote: >> Hi Al, >> >> On Mon, Aug 26, 2013 at 06:20:55PM +0100, Al Viro wrote: >> > On Mon, Aug 26, 2013 at 09:49:48AM -0700, Eric W. Biederman wrote: >> > >> >

Re: [PATCH 1/2] procfs: restore 0400 permissions on /proc/*/{syscall,stack,personality}

Cc'ed more people, On Tue, Aug 27, 2013 at 06:24:06PM +0100, Djalal Harouni wrote: > Hi Al, > > On Mon, Aug 26, 2013 at 06:20:55PM +0100, Al Viro wrote: > > On Mon, Aug 26, 2013 at 09:49:48AM -0700, Eric W. Biederman wrote: > > > > > How does changing the permissions to S_IRUSR prevent someone f

Re: [PATCH 1/2] procfs: restore 0400 permissions on /proc/*/{syscall,stack,personality}

Hi Al, On Mon, Aug 26, 2013 at 06:20:55PM +0100, Al Viro wrote: > On Mon, Aug 26, 2013 at 09:49:48AM -0700, Eric W. Biederman wrote: > > > How does changing the permissions to S_IRUSR prevent someone from > > opening the file before, and reading the file after a suid exec? > > > > > This patch r

Re: [PATCH 1/2] procfs: restore 0400 permissions on /proc/*/{syscall,stack,personality}

On Mon, Aug 26, 2013 at 09:49:48AM -0700, Eric W. Biederman wrote: > Djalal Harouni writes: > > > Avoid giving an fd on privileged files for free by switching these > > files to 0400 mode. > > This seems to be a revert of Al's patch in March of 2011 based on broken > reasoning. Yes it reverts so

Re: [PATCH 1/2] procfs: restore 0400 permissions on /proc/*/{syscall,stack,personality}

On Mon, Aug 26, 2013 at 09:49:48AM -0700, Eric W. Biederman wrote: > How does changing the permissions to S_IRUSR prevent someone from > opening the file before, and reading the file after a suid exec? > > > This patch restores the old mode which was 0400 > > Which seems to add no security whats

Re: [PATCH 1/2] procfs: restore 0400 permissions on /proc/*/{syscall,stack,personality}

Djalal Harouni writes: > Avoid giving an fd on privileged files for free by switching these > files to 0400 mode. This seems to be a revert of Al's patch in March of 2011 based on broken reasoning. Al Viro commited: > commit a9712bc12c40c172e393f85a9b2ba8db4bf59509 > Author: Al Viro > Date:

[PATCH 1/2] procfs: restore 0400 permissions on /proc/*/{syscall,stack,personality}

Avoid giving an fd on privileged files for free by switching these files to 0400 mode. This patch restores the old mode which was 0400 Signed-off-by: Djalal Harouni --- fs/proc/base.c | 12 ++-- 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/fs/proc/base.c b/fs/proc/base.