Edgar Toernig wrote:
>Your implementation is much cruder - it simply takes the fd
>away from the app; any future use gives EBADF. As a bonus,
>it works for regular files and even goes as far as destroying
>all mappings of the file from all processes (even root processes).
>IMVHO this is a disaster from a security and reliability point
>of view.
I'm still trying to understand the semantics of this proposed
frevoke() implementation. Can an attacker use this to forcibly
close some other processes' file descriptor? Suppose the target
process has fd 0 open and the attacker revokes the file corresponding
to fd 0; what is the state of fd 0 in the target process? Is it
closed? If the target process then open()s another file, does it
get bound to fd 0? (Recall that open() always binds to the lowest
unused fd.) If the answers are "yes", then the security consequences
seem very scary.
For example, suppose that the attacker opens some file onto fd 2,
forks and execs /bin/login (say), and revokes that fd while /bin/login
is in the middle of executing. Can this cause horrible catastrophes?
Note that, to defend against stderr attacks, some setuid programs will
forcibly open /dev/zero three times to make sure that fds 0, 1, and
2 are open, so that opening some later file (e.g., /etc/passwd)
doesn't inadvertently get attached to fd 2. If some other process
can forcibly close /bin/login's fd 2, then that's very bad.
Can something like the following happen?
Attacker /bin/login
-------- ----------
open("foo") -> 2
fork()
exec("/bin/login")
open("/dev/zero") -> 3
open("/dev/zero") -> 4
open("/dev/zero") -> 5
frevoke(2)
open("/etc/passwd") -> 2
...
perror("wrong password") # Corrupts /etc/passwd!
/* A hypothetical implementation of /bin/login: */
int main() {
// Protect ourselves from stderr attacks
int ignore;
ignore = open("/dev/zero");
ignore = open("/dev/zero");
ignore = open("/dev/zero");
int pwfd;
pwfd = open("/etc/passwd", O_RDWR);
...
if (!correctpassword(uname, pass)) {
perror("wrong password");
exit(1);
}
...
}
On Mon, Aug 07, 2006 at 10:52:59PM +0000, David Wagner wrote:
> I'm still trying to understand the semantics of this proposed
> frevoke() implementation. Can an attacker use this to forcibly
> close some other processes' file descriptor? Suppose the target
> process has fd 0 open and the attacker revokes the file corresponding
> to fd 0; what is the state of fd 0 in the target process? Is it
> closed? If the target process then open()s another file, does it
> get bound to fd 0? (Recall that open() always binds to the lowest
> unused fd.) If the answers are "yes", then the security consequences
> seem very scary.
No, that's already been answered at least once. The file remains open,
but returns EBADF on various operations.
--
Daniel Jacobowitz
CodeSourcery
On Monday 07 August 2006 17:56, Daniel Jacobowitz wrote:
> On Mon, Aug 07, 2006 at 10:52:59PM +0000, David Wagner wrote:
> > I'm still trying to understand the semantics of this proposed
> > frevoke() implementation. Can an attacker use this to forcibly
> > close some other processes' file descriptor? Suppose the target
> > process has fd 0 open and the attacker revokes the file corresponding
> > to fd 0; what is the state of fd 0 in the target process? Is it
> > closed? If the target process then open()s another file, does it
> > get bound to fd 0? (Recall that open() always binds to the lowest
> > unused fd.) If the answers are "yes", then the security consequences
> > seem very scary.
>
> No, that's already been answered at least once. The file remains open,
> but returns EBADF on various operations.
IIRC, it returns EBADF because the file actually gets closed. The file
descriptor, on the other hand, is permanently leaked.
Have these details changed?
Thanks,
Chase
Ar Llu, 2006-08-07 am 22:52 +0000, ysgrifennodd David Wagner:
> I'm still trying to understand the semantics of this proposed
> frevoke() implementation. Can an attacker use this to forcibly
> close some other processes' file descriptor? Suppose the target
No.
> process has fd 0 open and the attacker revokes the file corresponding
> to fd 0; what is the state of fd 0 in the target process? Is it
> closed? If the target process then open()s another file, does it
No its revoked. Just like a tty hangup
> get bound to fd 0? (Recall that open() always binds to the lowest
> unused fd.) If the answers are "yes", then the security consequences
> seem very scary.
Of course it doesn't. The BSD folk who added revoke were security people
not idiots.
Alan
Hi,
On Monday 07 August 2006 17:56, Daniel Jacobowitz wrote:
> > No, that's already been answered at least once. The file remains open,
> > but returns EBADF on various operations.
On 8/8/06, Chase Venters <[email protected]> wrote:
> IIRC, it returns EBADF because the file actually gets closed. The file
> descriptor, on the other hand, is permanently leaked.
>
> Have these details changed?
No. Your description is accurate.
Pekka