Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755925Ab0F2NAz (ORCPT ); Tue, 29 Jun 2010 09:00:55 -0400 Received: from mx1.redhat.com ([209.132.183.28]:59956 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755282Ab0F2NAx (ORCPT ); Tue, 29 Jun 2010 09:00:53 -0400 From: Steve Grubb Organization: Red Hat To: KOSAKI Motohiro Subject: Re: [PATCH v2] sanitize task->comm to avoid leaking escape codes Date: Tue, 29 Jun 2010 08:58:49 -0400 User-Agent: KMail/1.13.3 (Linux/2.6.33.5-124.fc13.x86_64; KDE/4.4.4; x86_64; ; ) Cc: Stefani Seibold , Kees Cook , linux-kernel@vger.kernel.org, "Greg Kroah-Hartman" , Andrew Morton , Tejun Heo , Veaceslav Falico , Alexander Viro , Oleg Nesterov , Neil Horman , Roland McGrath , Ingo Molnar , Peter Zijlstra , Hidetoshi Seto , Thomas Gleixner , Eric Paris , James Morris , "Andrew G. Morgan" , Dhaval Giani , "Serge E. Hallyn" , Christoph Hellwig , linux-fsdevel@vger.kernel.org References: <20100625082722.8031.A69D9226@jp.fujitsu.com> <1277747318.4840.9.camel@wall-e.seibold.net> <20100629115957.38BF.A69D9226@jp.fujitsu.com> In-Reply-To: <20100629115957.38BF.A69D9226@jp.fujitsu.com> MIME-Version: 1.0 Content-Type: Text/Plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit Message-Id: <201006290858.50387.sgrubb@redhat.com> Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 2646 Lines: 53 On Monday, June 28, 2010 11:05:56 pm KOSAKI Motohiro wrote: > > Am Freitag, den 25.06.2010, 08:56 +0900 schrieb KOSAKI Motohiro: > > > > Through get_task_comm() and many direct uses of task->comm in the > > > > kernel, it is possible for escape codes and other non-printables to > > > > leak into dmesg, syslog, etc. In the worst case, these strings > > > > could be used to attack administrators using vulnerable terminal > > > > emulators, and at least cause confusion through the injection of \r > > > > characters. > > > > > > > > This patch sanitizes task->comm to only contain printable characters > > > > when it is set. Additionally, it redefines get_task_comm so that it > > > > is more obvious when misused by callers (presently nothing was > > > > incorrectly calling get_task_comm's unsafe use of strncpy). For the audit system, we want the real, unsanitized task->comm. We record it in a special format to the audit logs such that unprintable characters are included. We want it exactly this way for certification purposes as well as forensic evidence if someone was playing games. If you do sanitize it for other areas of the kernel, please give us a way to get the unsanitized text. -Steve > > > > Signed-off-by: Kees Cook > > > > > > I've reviewed this patch briefly, Here is my personal concern... > > > > > > On Linux, non-printable leaking is fundamental, only fixing task->comm > > > doesn't solve syslog exploit issue. Probably all /proc/kmsg user should > > > have escaping non-pritables code. > > > > > > However, task->comm is one of most easy injection data of kernel, > > > because we have prctl(PR_SET_NAME), attacker don't need root > > > privilege. So, conservative assumption seems guard from crappy fault. > > > Plus, this patch is very small and our small TASK_COMM_LEN lead that > > > we don't need big performance concern. > > > > > > So, I don't find demerit in this proposal. but I'm not security > > > specialist, it's only personal thinking. > > > > Agree. I think a escaped printk should be a more generic solution. > > Is this possible? printk() doesn't know userland locale. how do it escape > correctly? When we only concern task->comm, assuming ascii-only string is > enough practical. but printk generic logic should allow non-ascii, I > think. > > I think userland reader process only know correct escaping way. -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/