Messages in this thread | | | Subject | Re: [PATCH 4/4] pmap: reduced permissions | From | Nix <> | Date | Wed, 25 Jan 2006 23:47:56 +0000 |
| |
On 23 Jan 2006, Albert Cahalan said: > On 1/23/06, Arjan van de Ven <arjan@infradead.org> wrote: >> On Mon, 2006-01-23 at 04:28 -0500, Albert Cahalan wrote: > >> > I tend to think that glibc should not be reading this file. >> > What excuse is there? >> >> glibc needs to be able to find out if a certain address is writable. (eg >> mapped "w"). The only way available for that is... reading the maps >> file. > > What the heck for? That's gross.
Ironically enough, it's security. :)
> If glibc is just providing this info for apps, there should be a > system call for it. Otherwise, being the C library, glibc can > damn well remember what it did.
Nah, it's used for vfprintf() argument-area checking.
Specifically, it's the Linux implementation of __readonly_area(), located in sysdeps/unix/sysv/linux/readonly-area.c in glibc-3.4-to-be, and used by vfprintf() on behalf of __vfprintf_chk(). Calls to this function (and the other __*_chk() functions) are expanded by glibc's string headers and generated by GCC 4.1+ automatically when possible (and by GCCs out there in the field: this patch is shipped by RH already, known as FORTIFY_SOURCE).
FORTIFY_SOURCE zaps a whole class of security vulnerabilities stone dead. Breaking it would be a bad idea. Therefore, /proc/self/maps has to remain readable, even in setuid programs, because setuid programs are one class of programs for which FORTIFY_SOURCE is crucial.
[Jakub added to Cc:, he can defend his own code much better than I can]
-- `Everyone has skeletons in the closet. The US has the skeletons driving living folks into the closet.' --- Rebecca Ore - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |