Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1762729Ab2FVVv5 (ORCPT ); Fri, 22 Jun 2012 17:51:57 -0400 Received: from mail-pb0-f46.google.com ([209.85.160.46]:64493 "EHLO mail-pb0-f46.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751386Ab2FVVvz convert rfc822-to-8bit (ORCPT ); Fri, 22 Jun 2012 17:51:55 -0400 MIME-Version: 1.0 In-Reply-To: <20120622143435.c1ba744e.akpm@linux-foundation.org> References: <20120622192413.GA5774@www.outflux.net> <20120622125551.269552c2.akpm@linux-foundation.org> <20120622143435.c1ba744e.akpm@linux-foundation.org> Date: Fri, 22 Jun 2012 14:51:54 -0700 X-Google-Sender-Auth: -oss2S4G1xz3wGMghhyahp_Gooc Message-ID: Subject: Re: [PATCH v3] fs: introduce pipe-only dump mode suid_dumpable=3 From: Kees Cook To: Andrew Morton Cc: linux-kernel@vger.kernel.org, Alan Cox , "Eric W. Biederman" , Alexander Viro , Rob Landley , Ingo Molnar , Peter Zijlstra , Doug Ledford , Marcel Holtmann , Serge Hallyn , Joe Korty , David Howells , James Morris , linux-doc@vger.kernel.org, linux-fsdevel@vger.kernel.org Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 8BIT X-System-Of-Record: true Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 2007 Lines: 50 On Fri, Jun 22, 2012 at 2:34 PM, Andrew Morton wrote: > On Fri, 22 Jun 2012 14:09:28 -0700 > Kees Cook wrote: > >> On Fri, Jun 22, 2012 at 12:55 PM, Andrew Morton >> wrote: >> > On Fri, 22 Jun 2012 12:24:13 -0700 >> > Kees Cook wrote: >> > >> >> The value >> >> of suid_dumpable=2 is now historic, and attempting to set this sysctl >> >> value returns -EINVAL. >> > >> > This sounds a bit harsh - will it not cause existing configurations to >> > immediately break? __If so, would it not be better to retain the =2 mode >> > for a while, and emit a nice warning when it is set? >> >> I view it as a security vulnerability, so I'd rather see it >> eliminated. I see "=1" as a security vulnerability too, but at least >> that's well-known to be a bad idea. The "=2" mode has been assumed to >> be safe, but it isn't. > > But what will be the effects of the change? ?People's initscripts do an > "echo 2" which fails and the error message (if any) won't get logged > anywhere where anyone looks. ?So now their machine is bumbling along in > the wrong mode and much later on, someone notices that coredumps are > going awry? ?This is not exactly a user-friendly way of rolling out > kernel API changes! Well, this is why I wanted to just change the meaning of "2" instead of introducing "3". It seems much cleaner to me. Just stop "2" from doing the dangerous thing and carry on. > And how serious is the security vulnerability, in real-world terms? > Serious enough to risk this amount of bustage? If they're running in mode "2" and they do not have a coredump pipe handler defined, local users can gain root access. -Kees -- Kees Cook Chrome OS Security -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/