To: linux-kernel@vger.kernel.org
Path: not-for-mail
From: daw@cs.berkeley.edu (David Wagner)
Newsgroups: isaac.lists.linux-kernel
Subject: Re: SECURITY PROBLEM: filesystem permiossion bypass on FD already opened
Date: Fri, 23 Oct 2009 22:55:57 +0000 (UTC)
Organization: University of California, Berkeley
Message-ID: <hbtc9t$629$1@taverner.cs.berkeley.edu>
References: <4AE20B6F.4060606@ntd.homelinux.org>
Reply-To: daw-news@cs.berkeley.edu (David Wagner)
NNTP-Posting-Host: taverner.cs.berkeley.edu
NNTP-Posting-Date: Fri, 23 Oct 2009 22:55:57 +0000 (UTC)
Originator: daw@taverner.cs.berkeley.edu (David Wagner)
Sender: linux-kernel-owner@vger.kernel.org
Content-Length: 871
Lines: 14

NiTRo  wrote:
>    Just discovered this security problem [...]
>If a FD is opened on a allowed file and then the permission is changed
>the file is still redeable starting from the already read position to
>the EOF.

This is not a security problem; this is Unix working as designed.
That's how file descriptors work.  File permissions are checked when
the file is opened, not on every read/write to the file descriptor.
That's a pretty fundamental aspect of how Unix works, and it is
well-documented and well-understood.

On the other hand, the /proc attack that Pavel explains *is* a
security problem.  But that's different.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/