From: Andrew Morton <akpm@linux-foundation.org>
To: Ingo Molnar <mingo@elte.hu>
Cc: Kees Cook <keescook@chromium.org>,
linux-kernel@vger.kernel.org,
Alexander Viro <viro@zeniv.linux.org.uk>,
Rik van Riel <riel@redhat.com>,
Federica Teodori <federica.teodori@googlemail.com>,
Lucian Adrian Grijincu <lucian.grijincu@gmail.com>,
Peter Zijlstra <a.p.zijlstra@chello.nl>,
Eric Paris <eparis@redhat.com>,
Randy Dunlap <rdunlap@xenotime.net>,
Dan Rosenberg <drosenberg@vsecurity.com>,
linux-doc@vger.kernel.org, linux-fsdevel@vger.kernel.org,
kernel-hardening@lists.openwall.com
Subject: Re: [PATCH v2012.1] fs: symlink restrictions on sticky directories
Date: Fri, 6 Jan 2012 01:58:08 -0800 [thread overview]
Message-ID: <20120106015808.1655d1c9.akpm@linux-foundation.org> (raw)
In-Reply-To: <20120106094339.GA9990@elte.hu>
On Fri, 6 Jan 2012 10:43:40 +0100 Ingo Molnar <mingo@elte.hu> wrote:
>
> * Andrew Morton <akpm@linux-foundation.org> wrote:
>
> > > +config PROTECTED_STICKY_SYMLINKS
> > > + bool "Protect symlink following in sticky world-writable directories"
> > > + default y
> > > + help
> > > + A long-standing class of security issues is the symlink-based
> > > + time-of-check-time-of-use race, most commonly seen in
> > > + world-writable directories like /tmp. The common method of
> > > + exploitation of this flaw is to cross privilege boundaries
> > > + when following a given symlink (i.e. a root process follows
> > > + a malicious symlink belonging to another user).
> > > +
> > > + Enabling this solves the problem by permitting symlinks to be
> > > + followed only when outside a sticky world-writable directory,
> > > + or when the uid of the symlink and follower match, or when
> > > + the directory and symlink owners match.
> >
> > This is all quite misleading. One would expect that
> > CONFIG_PROTECTED_STICKY_SYMLINKS turns the entire feature on
> > or off permanently. ie, it controls whether the code is
> > generated into vmlinux in the usual fashion. But it's not
> > that at all - the user gets the feature whether or not he
> > wants it, and this variable only sets the initial value.
> >
> > Why are we forcing the user to have the feature if he doesn't
> > want it, btw?
>
> Basing on the (not yet fully confirmed) assertion that no apps
> are broken by this change but exploits, I'd argue that this is
> actually the sane and correct semantics for symlinks - i.e. we
> want this to be the default Linux behavior - not just a
> 'feature'.
>
> That way the configuration knobs are compat settings in essence
> - in case some app cares.
>
> If people disagree and want it default off and as a separate
> feature then it has to be modularized out some more. There's
> notable silence from VFS folks on all this so Kees made an
> educated guess. It might be wrong.
Maybe true for a general purpose computer, but someone who is making a
single-purpose device such as a digital TV or a wifi router won't want
it.
> > And we appear to be enabling the feature if CONFIG_PROC_FS=n,
> > which might not be terribly useful?
>
> It can still be useful if it's default on - just cannot be
> turned off via /proc/sys/, right?
>
> The combination that is not so useful is when it's off and
> there's !PROC_FS. If it's a compat feature then i wouldnt bother
> about it. If it's a separated out modular feature in a separate
> .c file then it can all be properly shaped via Kconfig
> dependencies.
Spose so.
I'd have thought the way to configure this feature would be to have
CONFIG_PROTECTED_STICKY_SYMLINKS to control the code generation then a
0 or 1 CONFIG_PROTECTED_STICKY_SYMLINKS_ENABLED to control the initial
setting.
next prev parent reply other threads:[~2012-01-06 9:53 UTC|newest]
Thread overview: 21+ messages / expand[flat|nested] mbox.gz Atom feed top
2012-01-04 20:18 [PATCH v2012.1] fs: symlink restrictions on sticky directories Kees Cook
2012-01-05 9:17 ` Ingo Molnar
2012-01-05 19:36 ` Kees Cook
2012-01-06 7:36 ` Ingo Molnar
2012-01-06 9:21 ` Andrew Morton
2012-01-06 9:43 ` Ingo Molnar
2012-01-06 9:58 ` Andrew Morton [this message]
2012-01-06 10:05 ` Ingo Molnar
2012-01-06 10:33 ` Andrew Morton
2012-01-06 11:16 ` Ingo Molnar
2012-01-06 18:34 ` Kees Cook
2012-01-06 18:44 ` Kees Cook
2012-01-05 14:30 ` Nick Bowler
2012-01-05 19:34 ` Kees Cook
2012-01-05 20:08 ` Nick Bowler
2012-01-05 20:55 ` Kees Cook
2012-01-05 22:18 ` Nick Bowler
2012-01-06 0:08 ` Kees Cook
2012-01-06 2:05 ` Rik van Riel
2012-01-06 7:34 ` Ingo Molnar
2012-01-06 7:10 ` Ingo Molnar
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20120106015808.1655d1c9.akpm@linux-foundation.org \
--to=akpm@linux-foundation.org \
--cc=a.p.zijlstra@chello.nl \
--cc=drosenberg@vsecurity.com \
--cc=eparis@redhat.com \
--cc=federica.teodori@googlemail.com \
--cc=keescook@chromium.org \
--cc=kernel-hardening@lists.openwall.com \
--cc=linux-doc@vger.kernel.org \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=lucian.grijincu@gmail.com \
--cc=mingo@elte.hu \
--cc=rdunlap@xenotime.net \
--cc=riel@redhat.com \
--cc=viro@zeniv.linux.org.uk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).