Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751215AbWAYXsP (ORCPT ); Wed, 25 Jan 2006 18:48:15 -0500 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S1751218AbWAYXsO (ORCPT ); Wed, 25 Jan 2006 18:48:14 -0500 Received: from 41-052.adsl.zetnet.co.uk ([194.247.41.52]:62733 "EHLO mail.esperi.org.uk") by vger.kernel.org with ESMTP id S1751215AbWAYXsO (ORCPT ); Wed, 25 Jan 2006 18:48:14 -0500 To: Albert Cahalan Cc: Arjan van de Ven , "Albert D. Cahalan" , "Jakub Jelinek Al Viro" , linux-kernel@vger.kernel.org, akpm@osdl.org Subject: Re: [PATCH 4/4] pmap: reduced permissions References: <200601222219.k0MMJ3Qg209555@saturn.cs.uml.edu> <1137996654.2977.0.camel@laptopd505.fenrus.org> <787b0d920601230128o5a12513fjae3708e3fb552dca@mail.gmail.com> <1138009305.2977.28.camel@laptopd505.fenrus.org> <787b0d920601230220r5c7df60dk142d1d637ab4ed48@mail.gmail.com> From: Nix X-Emacs: resistance is futile; you will be assimilated and byte-compiled. Date: Wed, 25 Jan 2006 23:47:56 +0000 In-Reply-To: <787b0d920601230220r5c7df60dk142d1d637ab4ed48@mail.gmail.com> (Albert Cahalan's message of "23 Jan 2006 10:28:34 -0000") Message-ID: <87r76vrhsj.fsf@amaterasu.srvr.nix> User-Agent: Gnus/5.1006 (Gnus v5.10.6) XEmacs/21.4 (Corporate Culture, linux) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Sender: linux-kernel-owner@vger.kernel.org X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1866 Lines: 44 On 23 Jan 2006, Albert Cahalan said: > On 1/23/06, Arjan van de Ven wrote: >> On Mon, 2006-01-23 at 04:28 -0500, Albert Cahalan wrote: > >> > I tend to think that glibc should not be reading this file. >> > What excuse is there? >> >> glibc needs to be able to find out if a certain address is writable. (eg >> mapped "w"). The only way available for that is... reading the maps >> file. > > What the heck for? That's gross. Ironically enough, it's security. :) > If glibc is just providing this info for apps, there should be a > system call for it. Otherwise, being the C library, glibc can > damn well remember what it did. Nah, it's used for vfprintf() argument-area checking. Specifically, it's the Linux implementation of __readonly_area(), located in sysdeps/unix/sysv/linux/readonly-area.c in glibc-3.4-to-be, and used by vfprintf() on behalf of __vfprintf_chk(). Calls to this function (and the other __*_chk() functions) are expanded by glibc's string headers and generated by GCC 4.1+ automatically when possible (and by GCCs out there in the field: this patch is shipped by RH already, known as FORTIFY_SOURCE). FORTIFY_SOURCE zaps a whole class of security vulnerabilities stone dead. Breaking it would be a bad idea. Therefore, /proc/self/maps has to remain readable, even in setuid programs, because setuid programs are one class of programs for which FORTIFY_SOURCE is crucial. [Jakub added to Cc:, he can defend his own code much better than I can] -- `Everyone has skeletons in the closet. The US has the skeletons driving living folks into the closet.' --- Rebecca Ore - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/