re: [filemon] CVS commit: htdocs/support/security

2019-12-18 Thread matthew green
> As far as I can tell, there are many races caused by autoloading. i have long advocated that we should turn off both module autoload and autounload, as they're security and reliability nightmares. *perhaps* autoload, for a specific list of known OK modules would be OK in the default for me,

Re: [filemon] CVS commit: htdocs/support/security

2019-12-18 Thread David Holland
On Tue, Dec 17, 2019 at 02:19:01PM +0100, Maxime Villard wrote: > Typically with a character device, the kmod can get unloaded while an ioctl > is being executed on it. When it comes to syscalls, I haven't looked > closely, but the issue is likely the same. > > You can use tricks to "narrow

Re: [filemon] CVS commit: htdocs/support/security

2019-12-17 Thread Maxime Villard
Le 17/12/2019 à 15:44, Andrew Doran a écrit : Typically with a character device, the kmod can get unloaded while an ioctl is being executed on it. That's solvable. Conceptually I think the main stumbling block is that there are two layers at play which need to reconciled: specfs and devsw.

Re: [filemon] CVS commit: htdocs/support/security

2019-12-17 Thread Andrew Doran
On Tue, Dec 17, 2019 at 04:06:12PM +0100, Kamil Rytarowski wrote: > On 17.12.2019 15:44, Andrew Doran wrote: > Typically with a character device, the kmod can get unloaded while an > ioctl > is being executed on it. > > > > That's solvable. Conceptually I think the main stumbling

Re: [filemon] CVS commit: htdocs/support/security

2019-12-17 Thread Maxime Villard
Le 17/12/2019 à 12:34, Kamil Rytarowski a écrit : On 17.12.2019 09:16, Maxime Villard wrote: Module Name:    htdocs Committed By:   christos Date:   Tue Dec 17 01:03:49 UTC 2019 Modified Files:     htdocs/support/security: advisory.html index.html Log Message: new advisory To

Re: [filemon] CVS commit: htdocs/support/security

2019-12-17 Thread Paul Goyette
Please note that we do have a way of installing new syscalls (via the syscall_{,dis}establish() mechanism), but that only works for syscalls that are not currently in use. We don't have a (clean) way to replace an already-installed syscall (no way to retrieve the current function pointer). On

Re: [filemon] CVS commit: htdocs/support/security

2019-12-17 Thread Kamil Rytarowski
On 17.12.2019 15:44, Andrew Doran wrote: Typically with a character device, the kmod can get unloaded while an ioctl is being executed on it. > > That's solvable. Conceptually I think the main stumbling block is that > there are two layers at play which need to reconciled: specfs and

Re: [filemon] CVS commit: htdocs/support/security

2019-12-17 Thread Andrew Doran
> > > Typically with a character device, the kmod can get unloaded while an > > > ioctl > > > is being executed on it. That's solvable. Conceptually I think the main stumbling block is that there are two layers at play which need to reconciled: specfs and devsw. It could also be an opportunity

Re: [filemon] CVS commit: htdocs/support/security

2019-12-17 Thread Maxime Villard
Le 17/12/2019 à 14:32, Kamil Rytarowski a écrit : On 17.12.2019 14:19, Maxime Villard wrote: Le 17/12/2019 à 12:34, Kamil Rytarowski a écrit : On 17.12.2019 09:16, Maxime Villard wrote: Module Name:    htdocs Committed By:   christos Date:   Tue Dec 17 01:03:49 UTC 2019 Modified

Re: [filemon] CVS commit: htdocs/support/security

2019-12-17 Thread Kamil Rytarowski
On 17.12.2019 14:19, Maxime Villard wrote: > Le 17/12/2019 à 12:34, Kamil Rytarowski a écrit : >> On 17.12.2019 09:16, Maxime Villard wrote: Module Name:    htdocs Committed By:   christos Date:   Tue Dec 17 01:03:49 UTC 2019 Modified Files:

Re: [filemon] CVS commit: htdocs/support/security

2019-12-17 Thread Kamil Rytarowski
On 17.12.2019 09:16, Maxime Villard wrote: >> Module Name:    htdocs >> Committed By:   christos >> Date:   Tue Dec 17 01:03:49 UTC 2019 >> >> Modified Files: >>     htdocs/support/security: advisory.html index.html >> >> Log Message: >> new advisory >> >> >> To generate a diff of this