From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Date: Tue, 5 Jun 2018 13:34:09 +0100 From: Al Viro To: Ilya Matveychikov Cc: linux-kernel@vger.kernel.org, linux-fsdevel@vger.kernel.org Subject: Re: [PATCH] ksys_mount: check for permissions before resource allocation Message-ID: <20180605123409.GP30522@ZenIV.linux.org.uk> References: <20180605112641.GN30522@ZenIV.linux.org.uk> <1E519BA2-4198-4255-BAE4-3125C59741A3@gmail.com> <20180605115340.GO30522@ZenIV.linux.org.uk> <0F38EDA5-DEC3-48A1-9375-47949C26DAE8@gmail.com> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: <0F38EDA5-DEC3-48A1-9375-47949C26DAE8@gmail.com> Sender: linux-kernel-owner@vger.kernel.org List-ID: On Tue, Jun 05, 2018 at 04:07:15PM +0400, Ilya Matveychikov wrote: > > If you depend upon preventing kmalloc'ed temporary allocations filled > > with user-supplied data, you are screwed, plain and simple. It really can't > > be prevented, in a lot of ways that are much less exotic than mount(2). > > Most of syscall arguments are copied in, before we get any permission > > checks. It does happen and it will happen - examining them while they are > > still in userland is a nightmare in a lot of respects, starting with > > security. > > I agree that it’s impossible to completely avoid this kind of allocations > and examining data in user-land will be the bigger problem than copying > arguments to the kernel. But aside of that what’s wrong with the idea of > having the permission check before doing any kind of work? Presenting that as mitigating a vulnerability. It's neither better nor worse in that respect than the original.