lkml.org 
[lkml]   [2010]   [Jun]   [29]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    From
    SubjectRe: [PATCH v2] sanitize task->comm to avoid leaking escape codes
    Date
    > On Monday, June 28, 2010 11:05:56 pm KOSAKI Motohiro wrote:
    > > > Am Freitag, den 25.06.2010, 08:56 +0900 schrieb KOSAKI Motohiro:
    > > > > > Through get_task_comm() and many direct uses of task->comm in the
    > > > > > kernel, it is possible for escape codes and other non-printables to
    > > > > > leak into dmesg, syslog, etc. In the worst case, these strings
    > > > > > could be used to attack administrators using vulnerable terminal
    > > > > > emulators, and at least cause confusion through the injection of \r
    > > > > > characters.
    > > > > >
    > > > > > This patch sanitizes task->comm to only contain printable characters
    > > > > > when it is set. Additionally, it redefines get_task_comm so that it
    > > > > > is more obvious when misused by callers (presently nothing was
    > > > > > incorrectly calling get_task_comm's unsafe use of strncpy).
    >
    > For the audit system, we want the real, unsanitized task->comm. We record it
    > in a special format to the audit logs such that unprintable characters are
    > included. We want it exactly this way for certification purposes as well as
    > forensic evidence if someone was playing games. If you do sanitize it for
    > other areas of the kernel, please give us a way to get the unsanitized text.

    Probably this mail is offtopic. I think audit is unrelated with this discusstion. because when
    forensic, admins shouldn't believe task->comm at all. because 1) no path information,
    perhaps "ls" might mean "/home/attackers-dir/evil-script/ls" 2) easily obscured by
    prctl(PR_SET_NAME).

    That said, audit have to logged following two point if task name is necessary.
    1) exec
    2) prctl(PRT_SET_NAME)

    Thought ?





    \
     
     \ /
      Last update: 2010-06-30 02:19    [W:3.670 / U:0.004 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site