All of lore.kernel.org
 help / color / mirror / Atom feed
From: "Valdis Klētnieks" <valdis.kletnieks@vt.edu>
To: Andi Kleen <ak@linux.intel.com>
Cc: John Wood <john.wood@gmx.com>,
	kernelnewbies@kernelnewbies.org,
	Kees Cook <keescook@chromium.org>,
	kernel-hardening@lists.openwall.com
Subject: Re: Notify special task kill using wait* functions
Date: Fri, 09 Apr 2021 19:28:20 -0400	[thread overview]
Message-ID: <109781.1618010900@turing-police> (raw)
In-Reply-To: <20210409150621.GJ3762101@tassilo.jf.intel.com>

[-- Attachment #1: Type: text/plain, Size: 795 bytes --]

On Fri, 09 Apr 2021 08:06:21 -0700, Andi Kleen said:

> Thinking more about it what I wrote above wasn't quite right. The cache
> would only need to be as big as the number of attackable services/suid
> binaries. Presumably on many production systems that's rather small,
> so a cache (which wouldn't actually be a cache, but a complete database)
> might actually work.

You also need to consider non-suid things called by suid things that don't
sanitize input sufficiently before invocation...

Thinking about at - is it really a good thing to try to do this in kernelspace?
Or is 'echo 1 > /proc/sys/kernel/print-fatal-signals' and a program to watch
the dmesg and take action more appropriate?  A userspace monitor would
have more options (though a slightly higher risk of race conditions).


[-- Attachment #2: Type: application/pgp-signature, Size: 832 bytes --]

WARNING: multiple messages have this Message-ID (diff)
From: "Valdis Klētnieks" <valdis.kletnieks@vt.edu>
To: Andi Kleen <ak@linux.intel.com>
Cc: kernel-hardening@lists.openwall.com,
	John Wood <john.wood@gmx.com>, Kees Cook <keescook@chromium.org>,
	kernelnewbies@kernelnewbies.org
Subject: Re: Notify special task kill using wait* functions
Date: Fri, 09 Apr 2021 19:28:20 -0400	[thread overview]
Message-ID: <109781.1618010900@turing-police> (raw)
In-Reply-To: <20210409150621.GJ3762101@tassilo.jf.intel.com>


[-- Attachment #1.1: Type: text/plain, Size: 795 bytes --]

On Fri, 09 Apr 2021 08:06:21 -0700, Andi Kleen said:

> Thinking more about it what I wrote above wasn't quite right. The cache
> would only need to be as big as the number of attackable services/suid
> binaries. Presumably on many production systems that's rather small,
> so a cache (which wouldn't actually be a cache, but a complete database)
> might actually work.

You also need to consider non-suid things called by suid things that don't
sanitize input sufficiently before invocation...

Thinking about at - is it really a good thing to try to do this in kernelspace?
Or is 'echo 1 > /proc/sys/kernel/print-fatal-signals' and a program to watch
the dmesg and take action more appropriate?  A userspace monitor would
have more options (though a slightly higher risk of race conditions).


[-- Attachment #1.2: Type: application/pgp-signature, Size: 832 bytes --]

[-- Attachment #2: Type: text/plain, Size: 170 bytes --]

_______________________________________________
Kernelnewbies mailing list
Kernelnewbies@kernelnewbies.org
https://lists.kernelnewbies.org/mailman/listinfo/kernelnewbies

  parent reply	other threads:[~2021-04-09 23:28 UTC|newest]

Thread overview: 26+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-03-30 17:34 Notify special task kill using wait* functions John Wood
2021-03-30 18:40 ` Valdis Klētnieks
2021-04-02 12:49   ` John Wood
2021-04-03  3:50     ` Valdis Klētnieks
2021-04-03  7:02       ` John Wood
2021-04-03 21:34         ` Valdis Klētnieks
2021-04-04  9:48           ` John Wood
2021-04-04 21:10             ` Valdis Klētnieks
2021-04-05  7:31               ` John Wood
2021-04-06 23:55                 ` Valdis Klētnieks
2021-04-07 17:51                   ` John Wood
2021-04-07 17:51                     ` John Wood
2021-04-07 20:38                     ` Valdis Klētnieks
2021-04-07 20:38                       ` Valdis Klētnieks
2021-04-08  1:51                       ` Andi Kleen
2021-04-08  1:51                         ` Andi Kleen
2021-04-09 14:29                         ` John Wood
2021-04-09 14:29                           ` John Wood
2021-04-09 15:06                           ` Andi Kleen
2021-04-09 15:06                             ` Andi Kleen
2021-04-09 16:08                             ` John Wood
2021-04-09 16:08                               ` John Wood
2021-04-09 23:28                             ` Valdis Klētnieks [this message]
2021-04-09 23:28                               ` Valdis Klētnieks
2021-04-11  8:46                               ` John Wood
2021-04-11  8:46                                 ` John Wood

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=109781.1618010900@turing-police \
    --to=valdis.kletnieks@vt.edu \
    --cc=ak@linux.intel.com \
    --cc=john.wood@gmx.com \
    --cc=keescook@chromium.org \
    --cc=kernel-hardening@lists.openwall.com \
    --cc=kernelnewbies@kernelnewbies.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.