From mboxrd@z Thu Jan  1 00:00:00 1970
From: Alan Cox <alan@lxorguk.ukuu.org.uk>
Subject: Re: [PATCH v2] sanitize task->comm to avoid leaking escape codes
Date: Tue, 29 Jun 2010 10:36:50 +0100
Message-ID: <20100629103650.3b80e09f@lxorguk.ukuu.org.uk>
References: <20100624190527.GD5917@outflux.net>
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Cc: linux-kernel@vger.kernel.org, Greg Kroah-Hartman <gregkh@suse.de>,
	Andrew Morton <akpm@linux-foundation.org>,
	Tejun Heo <tj@kernel.org>,
	Veaceslav Falico <vfalico@redhat.com>,
	Alexander Viro <viro@zeniv.linux.org.uk>,
	Oleg Nesterov <oleg@redhat.com>,
	KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>,
	Neil Horman <nhorman@tuxdriver.com>,
	Roland McGrath <roland@redhat.com>,
	Ingo Molnar <mingo@elte.hu>,
	Peter Zijlstra <a.p.zijlstra@chello.nl>,
	Hidetoshi Seto <seto.hidetoshi@jp.fujitsu.com>,
	Stefani Seibold <stefani@seibold.net>,
	Thomas Gleixner <tglx@linutronix.de>,
	Eric Paris <eparis@redhat.com>,
	James Morris <jmorris@namei.org>,
	"Andrew G. Morgan" <morgan@kernel.org>,
	Dhaval Giani <dhaval.giani@gmail.com>,
	"Serge E. Hallyn" <serue@us.ibm.com>,
	Steve Grubb <sgrubb@redhat.com>,
	Christoph Hellwig <hch@lst.de>, linux-fsdevel@vger.kernel.org
To: Kees Cook <kees.cook@canonical.com>
Return-path: <linux-fsdevel-owner@vger.kernel.org>
Received: from earthlight.etchedpixels.co.uk ([81.2.110.250]:54526 "EHLO
	www.etchedpixels.co.uk" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org
	with ESMTP id S1754284Ab0F2Jdm (ORCPT
	<rfc822;linux-fsdevel@vger.kernel.org>);
	Tue, 29 Jun 2010 05:33:42 -0400
In-Reply-To: <20100624190527.GD5917@outflux.net>
Sender: linux-fsdevel-owner@vger.kernel.org
List-ID: <linux-fsdevel.vger.kernel.org>

> Through get_task_comm() and many direct uses of task->comm in the kernel,
> it is possible for escape codes and other non-printables to leak into
> dmesg, syslog, etc.  In the worst case, these strings could be used to
> attack administrators using vulnerable terminal emulators, and at least
> cause confusion through the injection of \r characters.

If an administrator has a vulnerable terminal emulator they have other
problems.

> This patch sanitizes task->comm to only contain printable characters
> when it is set.  Additionally, it redefines get_task_comm so that it is
> more obvious when misused by callers (presently nothing was incorrectly
> calling get_task_comm's unsafe use of strncpy).

This is a regression for tools that correctly handle unmutilated data.

> +	/* sanitize non-printable characters */
> +	for (i = 0; buf[i] && i < (sizeof(tsk->comm) - 1); i++) {
> +		if (!isprint(buf[i]))
> +			tsk->comm[i] = '?';

The kernel "isprint" isn't adequate for this. comm is set by the shell
based on argv[0] usually which means that in normal situations it is a
UTF-8 string.

Please do any filtering you must in the yama security module where it
only affects that. One way to approach it without losing data within the
module might be to use HTML style encoding within Yama so your own tools
can undo the 'sanitizing' rather than losing information ?

Ideally you want to the dev/inode pair of the thing being executed
printed as well - that will give real information for security purposes,
while the ->comm data is much more convenient for general debugging and
investigation than having to keep looking them up.

Alan