Messages in this thread | | | Date | Wed, 27 Jun 2007 23:19:11 -0700 | From | Andy Isaacson <> | Subject | Re: [patch 1/3] MAP_NOZERO - implement a new VM_NOZERO/MAP_NOZERO page retirement policy |
| |
On Tue, Jun 26, 2007 at 09:32:44PM -0700, Davide Libenzi wrote: > > Because an SUID program can change its UID back. > > > > At least, one that was SUID root. OTOH, any > > program running as root can change UID, so we > > should probably not allow root to get nonzeroed > > pages. > > Well, root can in general access the whole system in any case. At the > moment, root cannot access othe UIDs pages. Only their own. And this > differs from standard security policies where root can access everything. > Pages used internally by the kernel, cannot be reused by anyone.
But MAP_NOZERO adds a new possible information leak from root out to the non-root user. If root does
setuid(newuid); exec(...); exit(1);
and there are MAP_NOZERO pages which contain sensitive information, a process running as newuid would be able to race the exec with PTRACE_ATTACH and extract the sensitive information. Without MAP_NOZERO the information leak is limited to information which was in the setuid program's address space (and presumably, setuid programs are written to be careful about such things).
That said, I think I like the idea of MAP_NOZERO. Could it be generalized to some kind of "free pool" rather than keyed off of uid?
-andy - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |