From: Cyrill Gorcunov <gorcunov@gmail.com> To: Vasiliy Kulikov <segoon@openwall.com> Cc: Andrew Morton <akpm@linux-foundation.org>, "Kirill A. Shutemov" <kirill@shutemov.name>, containers@lists.osdl.org, linux-kernel@vger.kernel.org, linux-fsdevel@vger.kernel.org, Nathan Lynch <ntl@pobox.com>, kernel-hardening@lists.openwall.com, Oren Laadan <orenl@cs.columbia.edu>, Daniel Lezcano <dlezcano@fr.ibm.com>, Glauber Costa <glommer@parallels.com>, James Bottomley <jbottomley@parallels.com>, Tejun Heo <tj@kernel.org>, Alexey Dobriyan <adobriyan@gmail.com>, Al Viro <viro@ZenIV.linux.org.uk>, Pavel Emelyanov <xemul@parallels.com> Subject: Re: [patch 2/2] fs, proc: Introduce the /proc/<pid>/map_files/ directory v6 Date: Tue, 6 Sep 2011 00:36:27 +0400 [thread overview] Message-ID: <20110905203627.GL761@sun> (raw) In-Reply-To: <20110905194908.GA2690@albatros> On Mon, Sep 05, 2011 at 11:49:08PM +0400, Vasiliy Kulikov wrote: ... > > Actually, it can be speed up by introducing the same ptrace check. If > ptrace check fails, then just drop the dentry, otherwise continue to use > it. Then each revalidate would trigger ptrace check instead of full > drop-lookup-alloc cycle. If one process actively looks into > map_files/ or fd/, it will not become significantly slower. However, it > will trigger 2 capable() fail alerts in ptrace_may_access() instead of > one :) Hmm, at least it's better than trashing dcache I think. > > But I still see one very nasty issue - one may trigger this ptrace check, > trigger d_drop() and then look at /proc/slabinfo at "dentry" row. If > the number has changed, then the interested dentry existed before the > revalidate call. This infoleak is tricky to fix without any race. > > Probably it's time to close /proc/slabinfo infoleak? > Actually I miss to see how exactly this infoleak can be used by attacker or whoever. So, Vasiliy, what the security issue there? Cyrill
WARNING: multiple messages have this Message-ID (diff)
From: Cyrill Gorcunov <gorcunov@gmail.com> To: Vasiliy Kulikov <segoon@openwall.com> Cc: Andrew Morton <akpm@linux-foundation.org>, "Kirill A. Shutemov" <kirill@shutemov.name>, containers@lists.osdl.org, linux-kernel@vger.kernel.org, linux-fsdevel@vger.kernel.org, Nathan Lynch <ntl@pobox.com>, kernel-hardening@lists.openwall.com, Oren Laadan <orenl@cs.columbia.edu>, Daniel Lezcano <dlezcano@fr.ibm.com>, Glauber Costa <glommer@parallels.com>, James Bottomley <jbottomley@parallels.com>, Tejun Heo <tj@kernel.org>, Alexey Dobriyan <adobriyan@gmail.com>, Al Viro <viro@ZenIV.linux.org.uk>, Pavel Emelyanov <xemul@parallels.com> Subject: [kernel-hardening] Re: [patch 2/2] fs, proc: Introduce the /proc/<pid>/map_files/ directory v6 Date: Tue, 6 Sep 2011 00:36:27 +0400 [thread overview] Message-ID: <20110905203627.GL761@sun> (raw) In-Reply-To: <20110905194908.GA2690@albatros> On Mon, Sep 05, 2011 at 11:49:08PM +0400, Vasiliy Kulikov wrote: ... > > Actually, it can be speed up by introducing the same ptrace check. If > ptrace check fails, then just drop the dentry, otherwise continue to use > it. Then each revalidate would trigger ptrace check instead of full > drop-lookup-alloc cycle. If one process actively looks into > map_files/ or fd/, it will not become significantly slower. However, it > will trigger 2 capable() fail alerts in ptrace_may_access() instead of > one :) Hmm, at least it's better than trashing dcache I think. > > But I still see one very nasty issue - one may trigger this ptrace check, > trigger d_drop() and then look at /proc/slabinfo at "dentry" row. If > the number has changed, then the interested dentry existed before the > revalidate call. This infoleak is tricky to fix without any race. > > Probably it's time to close /proc/slabinfo infoleak? > Actually I miss to see how exactly this infoleak can be used by attacker or whoever. So, Vasiliy, what the security issue there? Cyrill
next prev parent reply other threads:[~2011-09-05 20:36 UTC|newest] Thread overview: 82+ messages / expand[flat|nested] mbox.gz Atom feed top 2011-08-31 7:58 [patch 0/2] Introduce /proc/pid/map_files v6 Cyrill Gorcunov 2011-08-31 7:58 ` [patch 1/2] fs, proc: Make proc_get_link to use dentry instead of inode Cyrill Gorcunov 2011-08-31 7:58 ` [patch 2/2] fs, proc: Introduce the /proc/<pid>/map_files/ directory v6 Cyrill Gorcunov 2011-08-31 9:06 ` Vasiliy Kulikov 2011-08-31 10:12 ` Cyrill Gorcunov 2011-08-31 11:26 ` Cyrill Gorcunov 2011-08-31 14:04 ` Kirill A. Shutemov 2011-08-31 14:09 ` Cyrill Gorcunov 2011-08-31 14:26 ` Cyrill Gorcunov 2011-08-31 22:10 ` Andrew Morton 2011-09-01 3:07 ` Kyle Moffett 2011-09-01 3:07 ` Kyle Moffett 2011-09-01 7:58 ` Pavel Emelyanov 2011-09-01 11:50 ` Tejun Heo 2011-09-01 12:13 ` Pavel Emelyanov 2011-09-01 17:13 ` Tejun Heo 2011-09-02 19:15 ` Matt Helsley 2011-09-02 0:09 ` Matt Helsley 2011-09-01 8:05 ` Cyrill Gorcunov 2011-09-02 16:37 ` Vasiliy Kulikov 2011-09-02 16:37 ` [kernel-hardening] " Vasiliy Kulikov 2011-09-05 18:53 ` Vasiliy Kulikov 2011-09-05 18:53 ` [kernel-hardening] " Vasiliy Kulikov 2011-09-05 19:20 ` Cyrill Gorcunov 2011-09-05 19:20 ` [kernel-hardening] " Cyrill Gorcunov 2011-09-05 19:49 ` Vasiliy Kulikov 2011-09-05 19:49 ` [kernel-hardening] " Vasiliy Kulikov 2011-09-05 20:36 ` Cyrill Gorcunov [this message] 2011-09-05 20:36 ` Cyrill Gorcunov 2011-09-06 10:15 ` Vasiliy Kulikov 2011-09-06 10:15 ` [kernel-hardening] " Vasiliy Kulikov 2011-09-06 16:51 ` Tejun Heo 2011-09-06 16:51 ` [kernel-hardening] " Tejun Heo 2011-09-06 17:29 ` Vasiliy Kulikov 2011-09-06 17:29 ` [kernel-hardening] " Vasiliy Kulikov 2011-09-06 17:33 ` Tejun Heo 2011-09-06 17:33 ` [kernel-hardening] " Tejun Heo 2011-09-06 18:15 ` Cyrill Gorcunov 2011-09-06 18:15 ` [kernel-hardening] " Cyrill Gorcunov [not found] ` <20110906173341.GM18425-9pTldWuhBndy/B6EtB590w@public.gmane.org> 2011-09-07 11:23 ` Vasiliy Kulikov 2011-09-07 11:23 ` [kernel-hardening] " Vasiliy Kulikov 2011-09-07 21:53 ` Cyrill Gorcunov 2011-09-07 21:53 ` [kernel-hardening] " Cyrill Gorcunov 2011-09-07 22:13 ` Andrew Morton 2011-09-07 22:13 ` [kernel-hardening] " Andrew Morton 2011-09-07 22:13 ` Andrew Morton 2011-09-07 22:42 ` Cyrill Gorcunov 2011-09-07 22:42 ` [kernel-hardening] " Cyrill Gorcunov 2011-09-07 22:53 ` Andrew Morton 2011-09-07 22:53 ` [kernel-hardening] " Andrew Morton 2011-09-07 22:53 ` Andrew Morton 2011-09-08 5:48 ` Cyrill Gorcunov 2011-09-08 5:48 ` [kernel-hardening] " Cyrill Gorcunov 2011-09-08 5:50 ` Cyrill Gorcunov 2011-09-08 5:50 ` [kernel-hardening] " Cyrill Gorcunov 2011-09-08 6:04 ` Cyrill Gorcunov 2011-09-08 6:04 ` [kernel-hardening] " Cyrill Gorcunov 2011-09-08 23:52 ` Andrew Morton 2011-09-08 23:52 ` [kernel-hardening] " Andrew Morton 2011-09-08 23:52 ` Andrew Morton 2011-09-09 0:24 ` Pavel Emelyanov 2011-09-09 0:24 ` [kernel-hardening] " Pavel Emelyanov 2011-09-09 0:24 ` Pavel Emelyanov 2011-09-09 5:48 ` Cyrill Gorcunov 2011-09-09 5:48 ` [kernel-hardening] " Cyrill Gorcunov 2011-09-09 6:00 ` Andrew Morton 2011-09-09 6:00 ` [kernel-hardening] " Andrew Morton 2011-09-09 6:22 ` Cyrill Gorcunov 2011-09-09 6:22 ` [kernel-hardening] " Cyrill Gorcunov 2011-09-10 13:21 ` Vasiliy Kulikov 2011-09-10 13:49 ` Cyrill Gorcunov 2011-09-01 10:46 ` Cyrill Gorcunov 2011-09-01 22:49 ` Andrew Morton 2011-09-01 23:04 ` Tejun Heo 2011-09-02 5:54 ` Cyrill Gorcunov 2011-09-02 5:53 ` Cyrill Gorcunov 2011-08-31 22:50 ` Andrew Morton 2011-09-02 1:54 ` Nicholas Miell 2011-09-02 1:58 ` Tejun Heo 2011-09-02 2:04 ` Nicholas Miell 2011-09-02 2:29 ` Tejun Heo 2011-09-02 8:07 ` Kirill A. Shutemov
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20110905203627.GL761@sun \ --to=gorcunov@gmail.com \ --cc=adobriyan@gmail.com \ --cc=akpm@linux-foundation.org \ --cc=containers@lists.osdl.org \ --cc=dlezcano@fr.ibm.com \ --cc=glommer@parallels.com \ --cc=jbottomley@parallels.com \ --cc=kernel-hardening@lists.openwall.com \ --cc=kirill@shutemov.name \ --cc=linux-fsdevel@vger.kernel.org \ --cc=linux-kernel@vger.kernel.org \ --cc=ntl@pobox.com \ --cc=orenl@cs.columbia.edu \ --cc=segoon@openwall.com \ --cc=tj@kernel.org \ --cc=viro@ZenIV.linux.org.uk \ --cc=xemul@parallels.com \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.