Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754821Ab0F2Jdo (ORCPT ); Tue, 29 Jun 2010 05:33:44 -0400 Received: from earthlight.etchedpixels.co.uk ([81.2.110.250]:54526 "EHLO www.etchedpixels.co.uk" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1754284Ab0F2Jdm (ORCPT ); Tue, 29 Jun 2010 05:33:42 -0400 Date: Tue, 29 Jun 2010 10:36:50 +0100 From: Alan Cox To: Kees Cook Cc: linux-kernel@vger.kernel.org, Greg Kroah-Hartman , Andrew Morton , Tejun Heo , Veaceslav Falico , Alexander Viro , Oleg Nesterov , KOSAKI Motohiro , Neil Horman , Roland McGrath , Ingo Molnar , Peter Zijlstra , Hidetoshi Seto , Stefani Seibold , Thomas Gleixner , Eric Paris , James Morris , "Andrew G. Morgan" , Dhaval Giani , "Serge E. Hallyn" , Steve Grubb , Christoph Hellwig , linux-fsdevel@vger.kernel.org Subject: Re: [PATCH v2] sanitize task->comm to avoid leaking escape codes Message-ID: <20100629103650.3b80e09f@lxorguk.ukuu.org.uk> In-Reply-To: <20100624190527.GD5917@outflux.net> References: <20100624190527.GD5917@outflux.net> X-Mailer: Claws Mail 3.7.6 (GTK+ 2.18.9; x86_64-redhat-linux-gnu) Face: iVBORw0KGgoAAAANSUhEUgAAADAAAAAwBAMAAAClLOS0AAAAFVBMVEWysKsSBQMIAwIZCwj///8wIhxoRDXH9QHCAAABeUlEQVQ4jaXTvW7DIBAAYCQTzz2hdq+rdg494ZmBeE5KYHZjm/d/hJ6NfzBJpp5kRb5PHJwvMPMk2L9As5Y9AmYRBL+HAyJKeOU5aHRhsAAvORQ+UEgAvgddj/lwAXndw2laEDqA4x6KEBhjYRCg9tBFCOuJFxg2OKegbWjbsRTk8PPhKPD7HcRxB7cqhgBRp9Dcqs+B8v4CQvFdqeot3Kov6hBUn0AJitrzY+sgUuiA8i0r7+B3AfqKcN6t8M6HtqQ+AOoELCikgQSbgabKaJW3kn5lBs47JSGDhhLKDUh1UMipwwinMYPTBuIBjEclSaGZUk9hDlTb5sUTYN2SFFQuPe4Gox1X0FZOufjgBiV1Vls7b+GvK3SU4wfmcGo9rPPQzgIabfj4TYQo15k3bTHX9RIw/kniir5YbtJF4jkFG+dsDK1IgE413zAthU/vR2HVMmFUPIHTvF6jWCpFaGw/A3qWgnbxpSm9MSmY5b3pM1gvNc/gQfwBsGwF0VCtxZgAAAAASUVORK5CYII= Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1885 Lines: 41 > Through get_task_comm() and many direct uses of task->comm in the kernel, > it is possible for escape codes and other non-printables to leak into > dmesg, syslog, etc. In the worst case, these strings could be used to > attack administrators using vulnerable terminal emulators, and at least > cause confusion through the injection of \r characters. If an administrator has a vulnerable terminal emulator they have other problems. > This patch sanitizes task->comm to only contain printable characters > when it is set. Additionally, it redefines get_task_comm so that it is > more obvious when misused by callers (presently nothing was incorrectly > calling get_task_comm's unsafe use of strncpy). This is a regression for tools that correctly handle unmutilated data. > + /* sanitize non-printable characters */ > + for (i = 0; buf[i] && i < (sizeof(tsk->comm) - 1); i++) { > + if (!isprint(buf[i])) > + tsk->comm[i] = '?'; The kernel "isprint" isn't adequate for this. comm is set by the shell based on argv[0] usually which means that in normal situations it is a UTF-8 string. Please do any filtering you must in the yama security module where it only affects that. One way to approach it without losing data within the module might be to use HTML style encoding within Yama so your own tools can undo the 'sanitizing' rather than losing information ? Ideally you want to the dev/inode pair of the thing being executed printed as well - that will give real information for security purposes, while the ->comm data is much more convenient for general debugging and investigation than having to keep looking them up. Alan -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/