public inbox for linux-rdma@vger.kernel.org
 help / color / mirror / Atom feed
From: Yann Droneaud <ydroneaud-RlY5vtjFyJ3QT0dZR+AlfA@public.gmane.org>
To: Jason Gunthorpe
	<jgunthorpe-ePGOBjL8dl3ta4EC/59zMFaTQe2KTcn/@public.gmane.org>
Cc: linux-rdma-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
Subject: Re: [PATCH 3/3] read_config: skip file/directory with unsecure permissions
Date: Thu, 08 Aug 2013 21:24:16 +0200	[thread overview]
Message-ID: <1375989856.27609.10.camel@localhost.localdomain> (raw)
In-Reply-To: <20130521205713.GB11318-ePGOBjL8dl3ta4EC/59zMFaTQe2KTcn/@public.gmane.org>

Hi,

Le mardi 21 mai 2013 à 14:57 -0600, Jason Gunthorpe a écrit :
> On Mon, May 20, 2013 at 11:43:05PM +0200, Yann Droneaud wrote:
> > libibverbs must refuse to load arbitrary shared objects.
> > 
> > This patch check the configuration directory and files for
> > - being owned by root;
> > - not being writable by others.
> 
> I really don't like this. Is there some exploit against /etc/ now that
> requires this sort of checking?
> 

Loading shared object as part of a setuid binary should be handled with
extra care.
Adding checks to the configuration loader is required so that only
trusted shared object get loaded.

Regards.

-- 
Yann Droneaud
OPTEYA

--
To unsubscribe from this list: send the line "unsubscribe linux-rdma" in
the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

  parent reply	other threads:[~2013-08-08 19:24 UTC|newest]

Thread overview: 13+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2013-05-20 21:43 [PATCH 0/3] make read_config() more robust Yann Droneaud
     [not found] ` <cover.1369085762.git.ydroneaud-RlY5vtjFyJ3QT0dZR+AlfA@public.gmane.org>
2013-05-20 21:43   ` [PATCH 1/3] read_config: ignore files beginning with '.' Yann Droneaud
2013-05-20 21:43   ` [PATCH 2/3] read_config: ignore directory entry with backup suffix (~) Yann Droneaud
2013-05-20 21:43   ` [PATCH 3/3] read_config: skip file/directory with unsecure permissions Yann Droneaud
     [not found]     ` <0a6888edc9d7899fe3b4af249c4f25088e196422.1369085762.git.ydroneaud-RlY5vtjFyJ3QT0dZR+AlfA@public.gmane.org>
2013-05-21 20:57       ` Jason Gunthorpe
     [not found]         ` <20130521205713.GB11318-ePGOBjL8dl3ta4EC/59zMFaTQe2KTcn/@public.gmane.org>
2013-08-08 19:24           ` Yann Droneaud [this message]
     [not found]             ` <1375989856.27609.10.camel-bi+AKbBUZKY6gyzm1THtWbp2dZbC/Bob@public.gmane.org>
2013-08-12 19:05               ` Jason Gunthorpe
     [not found]                 ` <20130812190545.GA7968-ePGOBjL8dl3ta4EC/59zMFaTQe2KTcn/@public.gmane.org>
2013-08-12 20:24                   ` Yann Droneaud
     [not found]                     ` <8d276f12593ddc79233fa41abdaf0d41-zgzEX58YAwA@public.gmane.org>
2013-08-12 20:39                       ` Jason Gunthorpe
     [not found]                         ` <20130812203935.GA8990-ePGOBjL8dl3ta4EC/59zMFaTQe2KTcn/@public.gmane.org>
2013-08-12 20:59                           ` Hefty, Sean
     [not found]                             ` <1828884A29C6694DAF28B7E6B8A8237388CA54FE-P5GAC/sN6hkd3b2yrw5b5LfspsVTdybXVpNB7YpNyf8@public.gmane.org>
2013-08-12 23:43                               ` Jason Gunthorpe
2013-05-22 21:32       ` Roland Dreier
     [not found]         ` <CAL1RGDX+XTMmwDQicztdJoq0oE0VfXvg5dhW8k-YEk38-vg6fw-JsoAwUIsXosN+BqQ9rBEUg@public.gmane.org>
2013-08-08 10:12           ` Yann Droneaud

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=1375989856.27609.10.camel@localhost.localdomain \
    --to=ydroneaud-rly5vtjfyj3qt0dzr+alfa@public.gmane.org \
    --cc=jgunthorpe-ePGOBjL8dl3ta4EC/59zMFaTQe2KTcn/@public.gmane.org \
    --cc=linux-rdma-u79uwXL29TY76Z2rM5mHXA@public.gmane.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox