lkml.org 
[lkml]   [2019]   [Sep]   [6]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: [PATCH v2 0/5] Add support for O_MAYEXEC
From
Date


> On Sep 6, 2019, at 12:07 PM, Steve Grubb <sgrubb@redhat.com> wrote:
>
>> On Friday, September 6, 2019 2:57:00 PM EDT Florian Weimer wrote:
>> * Steve Grubb:
>>> Now with LD_AUDIT
>>> $ LD_AUDIT=/home/sgrubb/test/openflags/strip-flags.so.0 strace ./test
>>> 2>&1 | grep passwd openat(3, "passwd", O_RDONLY) = 4
>>>
>>> No O_CLOEXEC flag.
>>
>> I think you need to explain in detail why you consider this a problem.
>
> Because you can strip the O_MAYEXEC flag from being passed into the kernel.
> Once you do that, you defeat the security mechanism because it never gets
> invoked. The issue is that the only thing that knows _why_ something is being
> opened is user space. With this mechanism, you can attempt to pass this
> reason to the kernel so that it may see if policy permits this. But you can
> just remove the flag.

I’m with Florian here. Once you are executing code in a process, you could just emulate some other unapproved code. This series is not intended to provide the kind of absolute protection you’re imagining.

What the kernel *could* do is prevent mmapping a non-FMODE_EXEC file with PROT_EXEC, which would indeed have a real effect (in an iOS-like world, for example) but would break many, many things.
\
 
 \ /
  Last update: 2019-09-06 21:27    [W:0.059 / U:0.932 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site