From: Vasiliy Kulikov <segoon@openwall.com>
To: kernel-hardening@lists.openwall.com
Cc: Pavel Labushev <p.labushev@gmail.com>
Subject: Re: [kernel-hardening] /proc/PID directory hiding (was: [owl-dev] segoon's status report - #1 of 15)
Date: Sun, 5 Jun 2011 00:20:47 +0400 [thread overview]
Message-ID: <20110604202018.GA8019@shinshilla> (raw)
In-Reply-To: <20110604181911.GC5034@openwall.com>
On Sat, Jun 04, 2011 at 22:19 +0400, Solar Designer wrote:
> > It is:
> > $ python -c 'import os; print os.stat("/proc/1")'
> > posix.stat_result(st_mode=16744, st_ino=535821L, st_dev=3L, st_nlink=6,
> > st_uid=0, st_gid=0, st_size=0L, st_atime=1306605485, st_mtime=1306605485,
> > st_ctime=1306605485)
> >
> > It's a known flaw and AFAIR it was considered irrelevant.
>
> Is the above on grsecurity?
No, grsecurity hides uid/gid from both *stat*(2) and getdents*(2) functions
(implemented as proc_pid_readdir() and pid_getattr()).
> As to probing for PIDs with syscalls such as kill(2), we may deal with
> that as well
I'd not do this. There are too many paths using pids, I don't think
there is some universal way (read: a bottleneck) to filter all accesses.
And the award is not too high to bother.
Thanks,
Vasiliy.
next prev parent reply other threads:[~2011-06-04 20:20 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <20110518150601.GA2921@albatros>
[not found] ` <20110524023409.GC12486@openwall.com>
[not found] ` <20110524151246.GA3401@albatros>
[not found] ` <4DE139FE.8050808@gmail.com>
2011-06-04 18:19 ` [kernel-hardening] /proc/PID directory hiding (was: [owl-dev] segoon's status report - #1 of 15) Solar Designer
2011-06-04 20:20 ` Vasiliy Kulikov [this message]
2011-06-04 21:03 ` Solar Designer
2011-06-05 0:10 ` [kernel-hardening] /proc/PID directory hiding Pavel Labushev
2011-06-05 1:18 ` Pavel Labushev
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20110604202018.GA8019@shinshilla \
--to=segoon@openwall.com \
--cc=kernel-hardening@lists.openwall.com \
--cc=p.labushev@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox