lkml.org 
[lkml]   [2013]   [May]   [22]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: PING^7 (was Re: [PATCH v2 00/14] Corrections and customization of the SG_IO command whitelist (CVE-2012-4542))
On Thu, May 23, 2013 at 07:17:37AM +0900, Tejun Heo wrote:
> > No, it doesn't. You can use SCM_RIGHTS, and pass a file descriptor for
> > the device node to an unprivileged program. You can choose the
> > users/groups that are allowed to access the device. In either case, the
> > privileged action is limited in time or in scope.
> >
> > The count-me-out knob affects all processes that use the device node,
> > and won't be cleaned up properly if you SIGKILL the (privileged)
> > process that sets it. So if you can avoid it, you should.
>
> Then let's make it fit the use case better. I really can't see much
> point in crafting the cdb filter when you basically have to entrust
> the device to the user anyway. Let's either trust the user with the

One more thing, is it really necessary to have finer granularity than
provided by file permissions? What would be the use case? Do you
expect to have multiple - two - differing levels of access with and
without SG_IO? Note that, for the same user, it's pointless to give
out SG_IO access to processes while denying for other processes. As
long as ptrace can be attached, hijacking such fd is easy. Making it
per-device should be suitable enough, no?

--
tejun


\
 
 \ /
  Last update: 2013-05-23 03:41    [W:0.095 / U:0.508 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site