In-Reply-To: <1168312045.3180.140.camel@laptopd505.fenrus.org>
To: Arjan van de Ven <arjan@infradead.org>
Cc: akpm@osdl.org, Christoph Hellwig <hch@infradead.org>,
       kjhall@linux.vnet.ibm.com, linux-kernel@vger.kernel.org,
       safford@watson.ibm.com
MIME-Version: 1.0
Subject: Re: mprotect abuse in slim
Message-ID: <OFCB9A1329.F623D1AA-ON8525725E.0075A270-8525725E.0076FD7E@us.ibm.com>
From: Mimi Zohar <zohar@us.ibm.com>
Date: Tue, 9 Jan 2007 16:30:54 -0500
Content-Type: text/plain; charset="US-ASCII"
Sender: linux-kernel-owner@vger.kernel.org
Content-Length: 1235
Lines: 30

Arjan van de Ven <arjan@infradead.org> wrote on 01/08/2007 10:07:25 PM:

> Hi,
> 
>maybe this is a silly question, but do you revoke not only the current
>fd entries, but also the ones that are pending in UNIX domain sockets
>and that are already being sent to the process? If not.. then you might
>as well not bother ;)
> 
>Greetings,
>   Arjan van de Ven

In the new slim code, which we haven't sent out but will soon, we added
the unix_may_send and unix_stream_connect hooks. The unix_may_send hook
prevents a demoted process from sending data on a higher integrity
socket; and the unix_may_connect hook prevents a process from
connecting to a lower integrity socket.  The integrity level of the
socket is based on the integrity of the file associated with the Unix
domain socket.

The bottom line is that although we don't demote the pending socket
and would allow it to connect at the higher integrity, we simply don't
allow anything of lesser integrity to be sent over it.

Mimi Zohar
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/