Re: [RFC/PATCH] revoke/frevoke system calls V2

Edgar Toernig wrote:
Your implementation is much cruder - it simply takes the fd
away from the app; any future use gives EBADF. As a bonus,
it works for regular files and even goes as far as destroying
all mappings of the file from all processes (even root processes).
IMVHO this is a disaster from a security and reliability point
of view.

I'm still trying to understand the semantics of this proposed
frevoke() implementation. Can an attacker use this to forcibly
close some other processes' file descriptor? Suppose the target
process has fd 0 open and the attacker revokes the file corresponding
to fd 0; what is the state of fd 0 in the target process? Is it
closed? If the target process then open()s another file, does it
get bound to fd 0? (Recall that open() always binds to the lowest
unused fd.) If the answers are "yes", then the security consequences
seem very scary.

For example, suppose that the attacker opens some file onto fd 2,
forks and execs /bin/login (say), and revokes that fd while /bin/login
is in the middle of executing. Can this cause horrible catastrophes?
Note that, to defend against stderr attacks, some setuid programs will
forcibly open /dev/zero three times to make sure that fds 0, 1, and
2 are open, so that opening some later file (e.g., /etc/passwd)
doesn't inadvertently get attached to fd 2. If some other process
can forcibly close /bin/login's fd 2, then that's very bad.

Can something like the following happen?

Attacker /bin/login
-------- ----------
open("foo") -> 2
fork()
exec("/bin/login")
open("/dev/zero") -> 3
open("/dev/zero") -> 4
open("/dev/zero") -> 5
frevoke(2)
open("/etc/passwd") -> 2
...
perror("wrong password") # Corrupts /etc/passwd!


/* A hypothetical implementation of /bin/login: */
int main() {
// Protect ourselves from stderr attacks
int ignore;
ignore = open("/dev/zero");
ignore = open("/dev/zero");
ignore = open("/dev/zero");

int pwfd;
pwfd = open("/etc/passwd", O_RDWR);
...
if (!correctpassword(uname, pass)) {
perror("wrong password");
exit(1);
}
...
}
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

Relevant Pages

  • Homework Help
    ... int one, two, three; ... // opens the file ... DayTime(); // default constructor ... bool operator < (DayTime otherDayTime); ...
    (comp.lang.cpp)
  • Re: How would you guys tackle this commonly occurring problem?
    ... I'm not so sure I would derive Creature from Object. ... int defense; ... void onAttack(Attacker& attacker, Object& target) { ...
    (comp.object)
  • Re: Hashed password secure?
    ... ]system, not by changing the OS-logon, but by having the user log on to ... that only opens up when a user logs on to ... ]store should be as safe as possible, and as resistent to brute force as ... A possible attacker *could* get his/her hands ...
    (sci.crypt)
  • execl bug?
    ... For example the program below opens a file, reads a line, rewinds ... then uses execl to call "cat -" which ought to send the file to stdout. ... I tried it on a Redhat box to see if everything behaves the same. ... int argc; ...
    (freebsd-hackers)
  • Re: /proc filesystem allows bypassing directory permissions on Linux
    ... Attacker opens my_priv and waits. ... # relax file permissions, directory is private, so this is safe ... Attacker uses openatto open and modify the "private" file. ...
    (Bugtraq)