We wtorek, 4 maja 2021 18:01:33 CEST Linus Torvalds pisze: > it's one of the reasons I didn't feel like doing splice() on > everything should be encouraged. This is why I agreed to change only /proc/*/maps. > The only reason to do this is basically for nefarious purposes, No real exploit I can think of needs to send this specific file, there are better candidates in procfs already. It only helps inspecting memory mappings off-line more reliably than LD_TRACE_LOADED_OBJECTS=1 in as little bytes as possible. Or maybe should it be discouraged on regular ext4 files as well? > Yes, yes, I'm sure pwntools can be used by white hats, but honestly, > that seems to be an almost secondary purpose. You got me. But honestly, I disagree, I have already seen pwntools used by malware analysts and python fans. > Why should the kernel _encourage_ and make it easy to do things like > this? What are the actual advantages for us to do this? Keeping it the way it is for the sake of security of userspace applications looks more like security through obscurity to me. I still agree that it may increase attack surface of the kernel. I did not try racing misaligned splices, nor mmapping files with strange names. Pwntools need to be adapted anyway in order to support 5.10-5.13 kernels; I just thought that this is a kind of a regression in the kernel, so I felt obliged to contribute a fix here, especially after I realized how simple the fix was. I heard that patches and their descriptions must really be top quality, but I was not prepared for justifying the change with anything more than 'it used to work, but is broken now, this patch brings it back'. -- Arusekk
