From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1760298AbcLSNeZ (ORCPT ); Mon, 19 Dec 2016 08:34:25 -0500 Received: from twin.jikos.cz ([89.185.236.188]:37048 "EHLO twin.jikos.cz" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1759139AbcLSNeY (ORCPT ); Mon, 19 Dec 2016 08:34:24 -0500 Date: Mon, 19 Dec 2016 14:34:00 +0100 (CET) From: Jiri Kosina X-X-Sender: jikos@twin.jikos.cz To: Greg KH cc: NeilBrown , kernel-hardening@lists.openwall.com, linux-kernel@vger.kernel.org Subject: Re: [RFC 0/4] make call_usermodehelper a bit more "safe" In-Reply-To: <20161216124913.GB31485@kroah.com> Message-ID: References: <20161214185000.GA3930@kroah.com> <87k2b0wus6.fsf@notabene.neil.brown.name> <20161216124913.GB31485@kroah.com> User-Agent: Alpine 2.00 (LRH 1167 2008-08-23) MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Fri, 16 Dec 2016, Greg KH wrote: > > You seem to be targeting a situation where the kernel memory can be > > easily changed, but filesystem content cannot (if it could - the > > attacker would simply replace /sbin/hotplug). > > Correct, like an embedded system with a read-only system partition, or > for when some kernel bug allows for random memory writes, yet privilege > escalation is hard to achieve for your process. Sorry, I really don't get this. If kernel memory can be easily changed (which is assumed here), why bother with all this? I'll just set current->uid to 0 and be done. -- Jiri Kosina SUSE Labs