On Tue, Jun 26, 2007 at 09:32:44PM -0700, Davide Libenzi wrote:
> > Because an SUID program can change its UID back.
> >
> > At least, one that was SUID root. OTOH, any
> > program running as root can change UID, so we
> > should probably not allow root to get nonzeroed
> > pages.
>
> Well, root can in general access the whole system in any case. At the
> moment, root cannot access othe UIDs pages. Only their own. And this
> differs from standard security policies where root can access everything.
> Pages used internally by the kernel, cannot be reused by anyone.
But MAP_NOZERO adds a new possible information leak from root out to the
non-root user. If root does
setuid(newuid);
exec(...);
exit(1);
and there are MAP_NOZERO pages which contain sensitive information,
a process running as newuid would be able to race the exec with
PTRACE_ATTACH and extract the sensitive information. Without MAP_NOZERO
the information leak is limited to information which was in the setuid
program's address space (and presumably, setuid programs are written to
be careful about such things).
That said, I think I like the idea of MAP_NOZERO. Could it be
generalized to some kind of "free pool" rather than keyed off of uid?
-andy
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
