Messages in this thread | | | Date | Tue, 17 Apr 2012 12:53:17 -0700 | Subject | Re: [PATCH c/r -mm] c/r: prctl: Simplify PR_SET_MM on mm::code/data assignment | From | Kees Cook <> |
| |
On Tue, Apr 17, 2012 at 12:49 PM, Cyrill Gorcunov <gorcunov@openvz.org> wrote: > On Tue, Apr 17, 2012 at 11:19:16PM +0400, Cyrill Gorcunov wrote: > ... >> > Since this is CAP_SYS_RESOURCE, and mmap_min_addr is CAP_SYS_RAWIO, >> > how about a lower-bounds check against mmap_min_addr? (We're already >> > doing the TASK_SIZE upper check, so this additional sanity checking >> > seems reasonable to me.) >> >> I think this is good idea, thanks Kees. I'll check it out. > > Updated and tested version is below. > > Cyrill > --- > From: Cyrill Gorcunov <gorcunov@openvz.org> > Subject: [PATCH] c/r: prctl: Simplify PR_SET_MM on mm::code/data assignment v2 > > The mm::start_code, end_code, start_data, end_data members > are set during startup of executable file and are not changed > after. > > But the program itself might map new executable or/and data areas in > time so the original values written into mm fields mentioned above > might not have correspond VMA area at all, thus if one try to > use this prctl codes without underlied VMA, the error will be > returned. > > Drop this requirement. This shrinks the code and eliminates > redundant calls to vma_flags_mismatch. The worst thing one can > do (if say to write some bad values here) -- the weird results > will be shown in /proc/$pid/statm or in /proc/pid/stat. > > Still, assignement of data on stack (such as command line and > environment variables) requires the underlied VMA to exist. > > v2: > Also make sure the address being set is greater than mmap_min_addr. > Suggested by Kees Cook. > > Signed-off-by: Cyrill Gorcunov <gorcunov@openvz.org>
Acked-by: Kees Cook <keescook@chromium.org>
-- Kees Cook ChromeOS Security -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |