Re: [RFC] Restrict writes into untrusted FIFOs and regular files

2017-09-19 Thread Solar Designer
On Tue, Sep 19, 2017 at 06:06:15PM +0200, Salvatore Mesoraca wrote: > 2017-09-19 2:37 GMT+02:00 Solar Designer : > > On Mon, Sep 18, 2017 at 02:00:50PM -0700, Kees Cook wrote: > >> On Fri, Sep 15, 2017 at 1:43 AM, Salvatore Mesoraca > >> wrote: > >> > +protected_regular_files: > >> > + > >> > +Th

Re: [RFC] Restrict writes into untrusted FIFOs and regular files

2017-09-19 Thread Salvatore Mesoraca
2017-09-19 2:37 GMT+02:00 Solar Designer : > On Mon, Sep 18, 2017 at 02:00:50PM -0700, Kees Cook wrote: >> On Fri, Sep 15, 2017 at 1:43 AM, Salvatore Mesoraca >> wrote: >> > The purpose is to make data spoofing attacks harder. >> >> Do you have any examples of attacks (CVEs, blog posts, etc) that

Re: [RFC] Restrict writes into untrusted FIFOs and regular files

2017-09-19 Thread Salvatore Mesoraca
2017-09-18 23:00 GMT+02:00 Kees Cook : > On Fri, Sep 15, 2017 at 1:43 AM, Salvatore Mesoraca > wrote: >> Disallows writing into FIFOs or regular files not owned by the user >> in world writable sticky directories, unless the owner is the same as >> that of the directory or the file is opened witho

Re: [RFC] Restrict writes into untrusted FIFOs and regular files

2017-09-18 Thread Solar Designer
On Mon, Sep 18, 2017 at 02:00:50PM -0700, Kees Cook wrote: > On Fri, Sep 15, 2017 at 1:43 AM, Salvatore Mesoraca > wrote: > > The purpose is to make data spoofing attacks harder. > > Do you have any examples of attacks (CVEs, blog posts, etc) that you > could link to in this commit? I doubt the

Re: [RFC] Restrict writes into untrusted FIFOs and regular files

2017-09-18 Thread Kees Cook
On Fri, Sep 15, 2017 at 1:43 AM, Salvatore Mesoraca wrote: > Disallows writing into FIFOs or regular files not owned by the user > in world writable sticky directories, unless the owner is the same as > that of the directory or the file is opened without the O_CREAT flag. Thanks for working on th