Re: [PATCH] pty: make ptmx file ops read-only after init

2016-09-21 Thread Jiri Slaby
On 09/14/2016, 06:17 PM, Kees Cook wrote: > Correct, this is a continuing effort to reduce the internal attack > surface of the kernel, where one of the most common exploitation > methods is overwriting function pointers. > > Some examples of attacks and mitigations are here: > http://kernsec.org/

Re: [PATCH] pty: make ptmx file ops read-only after init

2016-09-14 Thread Kees Cook
On Wed, Sep 14, 2016 at 7:04 AM, One Thousand Gnomes wrote: > On Wed, 14 Sep 2016 09:59:42 +0200 > Jiri Slaby wrote: > >> On 09/09/2016, 12:35 AM, Kees Cook wrote: >> > The ptmx_fops structure is only changed during init, so mark it as such. >> >> Right, but I am missing what is the benefit? You

Re: [PATCH] pty: make ptmx file ops read-only after init

2016-09-14 Thread One Thousand Gnomes
On Wed, 14 Sep 2016 09:59:42 +0200 Jiri Slaby wrote: > On 09/09/2016, 12:35 AM, Kees Cook wrote: > > The ptmx_fops structure is only changed during init, so mark it as such. > > Right, but I am missing what is the benefit? You would have to elaborate > here... The pages end up marked read onl

Re: [PATCH] pty: make ptmx file ops read-only after init

2016-09-14 Thread Jiri Slaby
On 09/09/2016, 12:35 AM, Kees Cook wrote: > The ptmx_fops structure is only changed during init, so mark it as such. Right, but I am missing what is the benefit? You would have to elaborate here... > Signed-off-by: Kees Cook > --- > drivers/tty/pty.c | 2 +- > 1 file changed, 1 insertion(+), 1

[PATCH] pty: make ptmx file ops read-only after init

2016-09-08 Thread Kees Cook
The ptmx_fops structure is only changed during init, so mark it as such. Signed-off-by: Kees Cook --- drivers/tty/pty.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/tty/pty.c b/drivers/tty/pty.c index 51e0d32883ba..a23fa5ed1d67 100644 --- a/drivers/tty/pty.c +++ b/