Re: [kernel-hardening] [RFC v2] procfs mount options

[Vasiliy Kulikov <segoon@openwall.com>]

Hi,

A small follow-up of my current work.

I'm implementing the scheme I've proposed on LKML.  Instead of on/off
semantics a mask of allowed files is passed as a mount option.  Like
this:

    mount -o tgid_allowed=.;cmdline;mounts;smaps /proc

All files not enumerated in tgid_allowed= will be restricted to
processes being able to ptrace the task.  Files enumerated in
tgid_allowed= are not additionally restricted and classic POSIX
permission checking rules are applied here.  So, it's impossible to
_relax_ procfs permissions with my scheme.

";" is used instead of "," as a comma is already used as options
separator.

Besides tgid_allowed= there will be attr_allowed= and tid_allowed= to
enumerated files in appropriate subdirectories.

As a "side effect" it will effectively fix all holes of poor permission
checking of setuid binaries (including check and execve() race) without
massive code refactoring.  (All future procfs files are already
protected too ;-))


Currently I have a working implementation of per-files restriction, but
without mount option parsing.  I'll post the code when I have a working
implementation of at least parsing and handling tgid_allowed=XXX.  Also
there is a (minor, I hope) issue with /proc/PID/maps handling, where
the ptrace check is too restrictive.

TODO: net restriction, privileged monitoring gid.

Thanks,

-- 
Vasiliy Kulikov
http://www.openwall.com - bringing security into open computing environments