From: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
To: Brad Spengler <spender@grsecurity.net>
Cc: kosaki.motohiro@jp.fujitsu.com,
Roland McGrath <roland@redhat.com>,
Linus Torvalds <torvalds@linux-foundation.org>,
Andrew Morton <akpm@linux-foundation.org>,
linux-kernel@vger.kernel.org, oss-security@lists.openwall.com,
Solar Designer <solar@openwall.com>,
Kees Cook <kees.cook@canonical.com>,
Al Viro <viro@zeniv.linux.org.uk>,
Oleg Nesterov <oleg@redhat.com>,
Neil Horman <nhorman@tuxdriver.com>,
linux-fsdevel@vger.kernel.org, pageexec@freemail.hu,
"Brad Spengler <spender@grsecurity.net> Eugene Teo"
<eugene@redhat.com>
Subject: Re: [PATCH 1/3] setup_arg_pages: diagnose excessive argument size
Date: Thu, 9 Sep 2010 14:31:18 +0900 (JST) [thread overview]
Message-ID: <20100909141534.C948.A69D9226@jp.fujitsu.com> (raw)
In-Reply-To: <20100908115728.GB11762@grsecurity.net>
> I still don't think this addresses the whole problem. Without question,
> the rlimit / 4 check is bogus. If nobody agrees with the intent of that
> check, then it should be removed, but I think the better solution is to
> fix the check so that it matches its original intent: let the initial
> stack setup be up to 1/Xth of the min(rlimit, TASK_SIZE dependent upon
> personality), which allows space for additional stack setup in the ELF
> loader and then further growth once the process is live. If that
> amount is overstepped, then the exec will return an error to the calling
> process instead of being terminated.
>
> It might be useful to consult with the people who introduced/approved
> the check in the first place, as they seemed to have reasons for
> implementing it.
Brad, sorry, I have bad news. glibc sysconf(_SC_ARG_MAX) is implemented
by hard coded RLIMIT_STACK/4 heuristics. That said, at least _now_, we
can't change this even though you disliked. That said, we can't break
userland even though userland library is very crazy.
I don't dislike your "1/Xth of the min(rlimit, TASK_SIZE dependent upon
> personality)" idea. however I think You and Roland haven't agreed this
point yet. he seems to want "unlimited" works as "unlimited". then, now
I don't make such patch. Instead, I would propose to insert
__vm_enough_memory() check in execve() pass. It prevent almost argv attack.
next prev parent reply other threads:[~2010-09-09 5:31 UTC|newest]
Thread overview: 81+ messages / expand[flat|nested] mbox.gz Atom feed top
2010-08-27 22:02 [PATCH] exec argument expansion can inappropriately trigger OOM-killer Kees Cook
2010-08-30 0:19 ` KOSAKI Motohiro
2010-08-30 0:56 ` Roland McGrath
2010-08-30 3:23 ` Solar Designer
2010-08-30 3:23 ` Solar Designer
2010-08-30 10:06 ` Roland McGrath
2010-08-30 19:48 ` Solar Designer
2010-08-31 0:40 ` Roland McGrath
2010-09-08 2:34 ` [PATCH 0/3] execve argument-copying fixes Roland McGrath
2010-09-08 2:34 ` Roland McGrath
2010-09-08 2:35 ` [PATCH 1/3] setup_arg_pages: diagnose excessive argument size Roland McGrath
2010-09-08 2:35 ` Roland McGrath
2010-09-08 8:29 ` pageexec
2010-09-08 8:29 ` pageexec
2010-09-10 8:59 ` Roland McGrath
2010-09-10 8:59 ` Roland McGrath
2010-09-11 13:30 ` pageexec
2010-09-11 13:30 ` pageexec-Y8qEzhMunLyT9ig0jae3mg
2010-09-14 19:33 ` Roland McGrath
2010-09-14 22:35 ` pageexec
2010-09-14 22:35 ` pageexec-Y8qEzhMunLyT9ig0jae3mg
2010-09-08 11:57 ` Brad Spengler
2010-09-08 11:57 ` Brad Spengler
2010-09-09 5:31 ` KOSAKI Motohiro [this message]
2010-09-09 5:31 ` KOSAKI Motohiro
2010-09-10 9:25 ` Roland McGrath
2010-09-10 9:25 ` Roland McGrath
2010-09-10 9:43 ` KOSAKI Motohiro
2010-09-11 13:39 ` pageexec
2010-09-11 13:39 ` pageexec-Y8qEzhMunLyT9ig0jae3mg
2010-09-14 18:51 ` Roland McGrath
2010-09-14 18:51 ` Roland McGrath
2010-09-14 20:28 ` pageexec
2010-09-14 20:28 ` pageexec-Y8qEzhMunLyT9ig0jae3mg
2010-09-14 21:16 ` Roland McGrath
2010-09-14 21:16 ` Roland McGrath
2010-09-14 22:27 ` pageexec
2010-09-14 22:27 ` pageexec-Y8qEzhMunLyT9ig0jae3mg
2010-09-14 23:04 ` Roland McGrath
2010-09-14 23:04 ` Roland McGrath
2010-09-15 9:27 ` pageexec
2010-09-15 9:27 ` pageexec-Y8qEzhMunLyT9ig0jae3mg
2010-09-10 9:18 ` Roland McGrath
2010-09-10 9:18 ` Roland McGrath
2010-09-08 2:36 ` [PATCH 2/3] execve: improve interactivity with large arguments Roland McGrath
2010-09-08 2:36 ` Roland McGrath
2010-09-08 2:37 ` [PATCH 3/3] execve: make responsive to SIGKILL " Roland McGrath
2010-09-08 2:37 ` Roland McGrath
2010-09-08 3:00 ` [PATCH 0/3] execve argument-copying fixes KOSAKI Motohiro
2010-09-08 3:00 ` KOSAKI Motohiro
2010-09-09 5:01 ` [PATCH 0/2] execve memory exhaust of " KOSAKI Motohiro
2010-09-09 5:01 ` KOSAKI Motohiro
2010-09-09 5:03 ` [PATCH 1/2] oom: don't ignore rss in nascent mm KOSAKI Motohiro
2010-09-09 5:03 ` KOSAKI Motohiro
2010-09-09 22:05 ` Oleg Nesterov
2010-09-09 22:05 ` Oleg Nesterov
2010-09-10 9:39 ` Roland McGrath
2010-09-10 9:39 ` Roland McGrath
2010-09-10 9:57 ` [PATCH] move cred_guard_mutex from task_struct to signal_struct KOSAKI Motohiro
2010-09-10 9:57 ` KOSAKI Motohiro
2010-09-10 17:24 ` Oleg Nesterov
2010-09-10 17:24 ` Oleg Nesterov
2010-09-16 5:51 ` KOSAKI Motohiro
2010-09-16 5:51 ` KOSAKI Motohiro
2010-09-09 5:04 ` [PATCH 2/2] execve: check the VM has enough memory at first KOSAKI Motohiro
2010-09-09 5:04 ` KOSAKI Motohiro
2010-09-10 15:06 ` Linus Torvalds
2010-09-10 15:06 ` Linus Torvalds
2010-09-14 1:52 ` KOSAKI Motohiro
2010-09-14 1:52 ` KOSAKI Motohiro
2010-09-16 5:51 ` KOSAKI Motohiro
2010-09-16 5:51 ` KOSAKI Motohiro
2010-09-16 15:01 ` Linus Torvalds
2010-09-16 15:01 ` Linus Torvalds
2010-08-30 17:49 ` [PATCH] exec argument expansion can inappropriately trigger OOM-killer Solar Designer
2010-08-30 17:49 ` Solar Designer
2010-08-30 22:08 ` Brad Spengler
2010-08-30 22:08 ` Brad Spengler
2010-08-31 11:53 ` Solar Designer
2010-08-31 11:53 ` Solar Designer
2010-08-31 11:56 ` [PATCH] exec argument expansion can inappropriately triggerOOM-killer Tetsuo Handa
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20100909141534.C948.A69D9226@jp.fujitsu.com \
--to=kosaki.motohiro@jp.fujitsu.com \
--cc=akpm@linux-foundation.org \
--cc=eugene@redhat.com \
--cc=kees.cook@canonical.com \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=nhorman@tuxdriver.com \
--cc=oleg@redhat.com \
--cc=oss-security@lists.openwall.com \
--cc=pageexec@freemail.hu \
--cc=roland@redhat.com \
--cc=solar@openwall.com \
--cc=spender@grsecurity.net \
--cc=torvalds@linux-foundation.org \
--cc=viro@zeniv.linux.org.uk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.