All of lore.kernel.org
 help / color / mirror / Atom feed
From: John Wood <john.wood@gmx.com>
To: "Valdis Klētnieks" <valdis.kletnieks@vt.edu>,
	"Andi Kleen" <ak@linux.intel.com>
Cc: kernel-hardening@lists.openwall.com,
	John Wood <john.wood@gmx.com>, Kees Cook <keescook@chromium.org>,
	kernelnewbies@kernelnewbies.org
Subject: Re: Notify special task kill using wait* functions
Date: Sun, 11 Apr 2021 10:46:02 +0200	[thread overview]
Message-ID: <20210411084602.GA3111@ubuntu> (raw)
In-Reply-To: <109781.1618010900@turing-police>

Hi,

On Fri, Apr 09, 2021 at 07:28:20PM -0400, Valdis Klētnieks wrote:
> On Fri, 09 Apr 2021 08:06:21 -0700, Andi Kleen said:
>
> > Thinking more about it what I wrote above wasn't quite right. The cache
> > would only need to be as big as the number of attackable services/suid
> > binaries. Presumably on many production systems that's rather small,
> > so a cache (which wouldn't actually be a cache, but a complete database)
> > might actually work.
>
> You also need to consider non-suid things called by suid things that don't
> sanitize input sufficiently before invocation...
>
> Thinking about at - is it really a good thing to try to do this in kernelspace?
> Or is 'echo 1 > /proc/sys/kernel/print-fatal-signals' and a program to watch
> the dmesg and take action more appropriate?  A userspace monitor would
> have more options (though a slightly higher risk of race conditions).
>

Thanks for the ideas. I need some time to send a formal proposal that
works properly. I would like to get feedback at that moment. I think it
would be better to discuss about the real patch.

Again, thanks.
John Wood

_______________________________________________
Kernelnewbies mailing list
Kernelnewbies@kernelnewbies.org
https://lists.kernelnewbies.org/mailman/listinfo/kernelnewbies

WARNING: multiple messages have this Message-ID (diff)
From: John Wood <john.wood@gmx.com>
To: "Valdis Klētnieks" <valdis.kletnieks@vt.edu>,
	"Andi Kleen" <ak@linux.intel.com>
Cc: John Wood <john.wood@gmx.com>,
	kernelnewbies@kernelnewbies.org,
	Kees Cook <keescook@chromium.org>,
	kernel-hardening@lists.openwall.com
Subject: Re: Notify special task kill using wait* functions
Date: Sun, 11 Apr 2021 10:46:02 +0200	[thread overview]
Message-ID: <20210411084602.GA3111@ubuntu> (raw)
In-Reply-To: <109781.1618010900@turing-police>

Hi,

On Fri, Apr 09, 2021 at 07:28:20PM -0400, Valdis Klētnieks wrote:
> On Fri, 09 Apr 2021 08:06:21 -0700, Andi Kleen said:
>
> > Thinking more about it what I wrote above wasn't quite right. The cache
> > would only need to be as big as the number of attackable services/suid
> > binaries. Presumably on many production systems that's rather small,
> > so a cache (which wouldn't actually be a cache, but a complete database)
> > might actually work.
>
> You also need to consider non-suid things called by suid things that don't
> sanitize input sufficiently before invocation...
>
> Thinking about at - is it really a good thing to try to do this in kernelspace?
> Or is 'echo 1 > /proc/sys/kernel/print-fatal-signals' and a program to watch
> the dmesg and take action more appropriate?  A userspace monitor would
> have more options (though a slightly higher risk of race conditions).
>

Thanks for the ideas. I need some time to send a formal proposal that
works properly. I would like to get feedback at that moment. I think it
would be better to discuss about the real patch.

Again, thanks.
John Wood

  reply	other threads:[~2021-04-11  8:48 UTC|newest]

Thread overview: 26+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-03-30 17:34 Notify special task kill using wait* functions John Wood
2021-03-30 18:40 ` Valdis Klētnieks
2021-04-02 12:49   ` John Wood
2021-04-03  3:50     ` Valdis Klētnieks
2021-04-03  7:02       ` John Wood
2021-04-03 21:34         ` Valdis Klētnieks
2021-04-04  9:48           ` John Wood
2021-04-04 21:10             ` Valdis Klētnieks
2021-04-05  7:31               ` John Wood
2021-04-06 23:55                 ` Valdis Klētnieks
2021-04-07 17:51                   ` John Wood
2021-04-07 17:51                     ` John Wood
2021-04-07 20:38                     ` Valdis Klētnieks
2021-04-07 20:38                       ` Valdis Klētnieks
2021-04-08  1:51                       ` Andi Kleen
2021-04-08  1:51                         ` Andi Kleen
2021-04-09 14:29                         ` John Wood
2021-04-09 14:29                           ` John Wood
2021-04-09 15:06                           ` Andi Kleen
2021-04-09 15:06                             ` Andi Kleen
2021-04-09 16:08                             ` John Wood
2021-04-09 16:08                               ` John Wood
2021-04-09 23:28                             ` Valdis Klētnieks
2021-04-09 23:28                               ` Valdis Klētnieks
2021-04-11  8:46                               ` John Wood [this message]
2021-04-11  8:46                                 ` John Wood

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20210411084602.GA3111@ubuntu \
    --to=john.wood@gmx.com \
    --cc=ak@linux.intel.com \
    --cc=keescook@chromium.org \
    --cc=kernel-hardening@lists.openwall.com \
    --cc=kernelnewbies@kernelnewbies.org \
    --cc=valdis.kletnieks@vt.edu \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.