Re: [PATCH v2 1/2] procfs: make /proc/*/{stack,syscall,personality} 0400

2014-04-15 Thread Djalal Harouni
On Fri, Mar 28, 2014 at 03:32:31PM -0700, Andrew Morton wrote: > On Sat, 22 Mar 2014 14:37:39 +0100 Djalal Harouni wrote: > > > These procfs files contain sensitive information and currently their > > mode is 0444. Change this to 0400, so the VFS will be able to block > > unprivileged processes f

Re: [PATCH v2 1/2] procfs: make /proc/*/{stack,syscall,personality} 0400

2014-04-02 Thread Oleg Nesterov
On 03/28, Andrew Morton wrote: > > Now for a six-year-late code review: > > - How the heck can target==current in task_current_syscall()? > > - Less talk, more action: > > From: Andrew Morton > Subject: lib/syscall.c: unexport task_current_syscall() > > It is only used by procfs and procfs cannot

Re: [PATCH v2 1/2] procfs: make /proc/*/{stack,syscall,personality} 0400

2014-03-28 Thread Andrew Morton
On Sat, 22 Mar 2014 14:37:39 +0100 Djalal Harouni wrote: > These procfs files contain sensitive information and currently their > mode is 0444. Change this to 0400, so the VFS will be able to block > unprivileged processes from getting file descriptors on arbitrary > privileged /proc/*/{stack,sys

Re: [PATCH v2 1/2] procfs: make /proc/*/{stack,syscall,personality} 0400

2014-03-25 Thread Djalal Harouni
Hi Alexey, On Mon, Mar 24, 2014 at 04:41:43PM +0300, Alexey Dobriyan wrote: > > - ONE("stack", S_IRUGO, proc_pid_stack), > > + ONE("stack", S_IRUSR, proc_pid_stack), > > no love for /proc/*/wchan? Yes you are right, didn't want to modify lot of things, and I missed that one. So there

Re: [PATCH v2 1/2] procfs: make /proc/*/{stack,syscall,personality} 0400

2014-03-24 Thread Alexey Dobriyan
> - ONE("stack", S_IRUGO, proc_pid_stack), > + ONE("stack", S_IRUSR, proc_pid_stack), no love for /proc/*/wchan? -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org

[PATCH v2 1/2] procfs: make /proc/*/{stack,syscall,personality} 0400

2014-03-22 Thread Djalal Harouni
These procfs files contain sensitive information and currently their mode is 0444. Change this to 0400, so the VFS will be able to block unprivileged processes from getting file descriptors on arbitrary privileged /proc/*/{stack,syscall,personality} files. This reduces the scope of ASLR leaking an