-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Kees Cook wrote: > On Tue, Nov 6, 2012 at 12:10 AM, P J P <ppandit@xxxxxxxxxx> wrote: >> >> Hello Kees, Al, >> >> +-- On Sat, 27 Oct 2012, Kees Cook wrote --+ | If we change >> binfmt_script to not make a recursive call, then we still | need >> to keep the interp change somewhere off the stack. I still think >> | my patchset is the least bad. | | Al, do you have something >> else in mind? >> >> Guys, are there any updates further? >> >> Al, what's your take on the *rare* extra call to request_module? > > Without any other feedback, I'd like to use my minimal allocation > patch, since it fixes the problem and doesn't change any of the > semantics of how/when loading happens. As a first step, I think that we can go with the Keess' (nice/small/simple) patch. On the long run, exec should be reworked. Not only interp is modified, also credentials are set, e.g. when using "ping" as interpreter. With intransparent error handling and retry-logic, this might be a future local-root-exploit in the beginning (I tried to, but did not manage yet). Also a remark from Prasad Pandit did not make it to the list (or at least I missed the replies). > Yesterday, while testing Keess' patch I was reading through > execve(2) manual which says: path name must be a valid executable > which is NOT a script. > > $ man execve ... Interpreter scripts An interpreter script is a > text file that has execute permission enabled and whose first line > is of the form: > > #! interpreter [optional-arg] > > The interpreter must be a valid path name for an executable which > is not itself a script. Does someone know what POSIX says about that? I guess that interp recursion might have some usecases: Script uses interp, but interp was wrapped by admin or distribution folks into another script to fix something, e.g. to pass an additional arg. hd - -- http://www.halfdog.net/ PGP: 156A AE98 B91F 0114 FE88 2BD8 C459 9386 feed a bee -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) iEYEARECAAYFAlCh7ZEACgkQxFmThv7tq+4X/QCeLN+0qUtP6Hhag1d4iwZ4PZbL evEAn2iPQH9mJ0zTHMs3qOsaWLRs9UWW =Ow3u -----END PGP SIGNATURE----- -- To unsubscribe from this list: send the line "unsubscribe linux-fsdevel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
