Andrew Morton wrote:
On Thu, 8 Mar 2007 12:55:25 -0800 Kees Cook <[EMAIL PROTECTED]> wrote:
On Tue, Mar 06, 2007 at 08:22:11PM -0800, Arjan van de Ven wrote:
[Adding Cc:lkml]
How about using a reduced check, as is done for fd and environ? This
would allow root-running system monitors to still do their job.
Effectively, this changes the test from "is ptracing" to just "can
ptrace".
If this still isn't considered safe, I'll add the maps_protect file...
btw I consider it an information leak that any user can see which
files/libraries any other user and root has mmap'd. (and with glibc's
stdio mmap feature that goes even beyond direct mmap to fopen()'d).
If root or some other user wants to watch
hillary-vs-obama-in-the-mud.avi, no other user has ANY business even
seeing that. So at minimum it's a privacy issue showing the filenames...
So, what's the state of this? Is the reduced "allowed to ptrace" check
good enough for inclusion? What is needed for some form of this patch
to be included? I'm happy to try new approaches if I can get some
further input.
I just don't know what it will break - we're changing things so that user A
cannot monitor user B's memory maps. I feel that it's sure to break
various people's fancy custom system activity monitoring/logging setups,
and the sort of users who will be affected are, alas, the sort of people
who won't run a kernel with this change in it for another couple of years
yet.
except if they run RHEL or FC kernels, in which case they already have
that change
Do we actually need to disable the whole interface? If all you're
concerned about is the pathname then perhaps the knob could cause that
pathname to be replaced with "<hidden>". That'll cause things to
break less seriously and still allows somewhat useful info to be gathered.
the problem part is that you can see EXACLTY where glibc is loaded in
memory, which effectively defeats address space randomization for
local users....
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
