Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755209Ab1F2LU6 (ORCPT ); Wed, 29 Jun 2011 07:20:58 -0400 Received: from mail-ew0-f46.google.com ([209.85.215.46]:42291 "EHLO mail-ew0-f46.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753403Ab1F2LUy (ORCPT ); Wed, 29 Jun 2011 07:20:54 -0400 Date: Wed, 29 Jun 2011 15:20:45 +0400 From: Vasiliy Kulikov To: Balbir Singh Cc: KOSAKI Motohiro , linux-kernel@vger.kernel.org, balbir@linux.vnet.ibm.com, akpm@linux-foundation.org, viro@zeniv.linux.org.uk, rientjes@google.com, wilsons@start.ca, security@kernel.org, eparis@redhat.com, kernel-hardening@lists.openwall.com, Linus Torvalds Subject: Re: [PATCH 1/2] proc: restrict access to /proc/PID/io Message-ID: <20110629112045.GA29011@albatros> References: <1308917318-4749-1-git-send-email-segoon@openwall.com> <4E07F1C0.2070305@jp.fujitsu.com> <20110627070300.GA4463@albatros> <4E08324D.9040605@jp.fujitsu.com> <20110627085242.GA6635@albatros> <20110628075053.GA4009@albatros> MIME-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: User-Agent: Mutt/1.5.20 (2009-06-14) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 2225 Lines: 54 On Wed, Jun 29, 2011 at 06:46 +0530, Balbir Singh wrote: > On Tue, Jun 28, 2011 at 1:20 PM, Vasiliy Kulikov wrote: > > On Tue, Jun 28, 2011 at 06:54 +0530, Balbir Singh wrote: > >> > As to rounding - this is a workaround, not a fix. ?What if some program > >> > reads one byte from tty and then do some io activity exactly of 1kb-1? > >> > Then you just measure kbs and get original tty activity. ?(just a crazy > >> > example to show that it is not a full solution.) > >> > > >> > >> That would happen with a probability of 1/1024 > > > > I'd not claim about probability here, but anyway rounding would be not > > a fix, just a workaround. ?Also note that the random value is program > > dependent, it is not chosen at the program start time or anything > > similar. ?IOW, if the program is vulnerable, it is vulnerable with 100% > > probability. > > > > I was thinking along ASLR lines, ASLR reduces the probability of > malware finding specific address in code, but does not eliminate it > completely. You confuse a bug fix with a prevention of an exploitation technique here. ASLR doesn't fix anything, it tries to break exploits that use bugs like arbitrary writes/reads. If there is arbitrary write bug, almost always the game is over; that's why such probabilistic measure is acceptable. On the contrary, /proc/*/io leak is a bug, which is fairly fixable by restricting an access (breaking programs, though). So, from the security point of view these cases are not comparable. > In the worst case as you suggest may > be the statistics would be available only to root, but that is the > final drop down scenario. Yes, it breaks iotop, but it is a full solution. > No we don't clear taskstats info on credential changes. If taskstats info is allowed to travel through credential changes, it exposes the similar private information. Thanks, -- Vasiliy Kulikov http://www.openwall.com - bringing security into open computing environments -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/