Re: [PATCH 1/2] proc: restrict access to /proc/PID/io

[Vasiliy Kulikov <segoon@openwall.com>]

On Tue, Jun 28, 2011 at 06:43 +0530, Balbir Singh wrote:
> On Fri, Jun 24, 2011 at 5:38 PM, Vasiliy Kulikov <segoon@openwall.com> wrote:
> > /proc/PID/io may be used for gathering private information.  E.g. for
> > openssh and vsftpd daemons wchars/rchars may be used to learn the
> > precise password length.  Restrict it to processes being able to ptrace
> > the target process.
> >
> 
> Hmm.. How do I reproduce this,

Just register taskstats listener and wait for "vsftpd" process.
read_characters = strlen("USER username\r\n") + strlen("PASSWD
pass\r\n") + 1.

> won't they be enough randomness around
> rchar/wchar by the time the attacker reads it?

No, if you set "UsePrivilegeSeparation yes" in /etc/sshd/sshd_config or
similar setting in vsftpd config (set by default), one process will
have very small io activity, which is 100% related to the io in
question.

http://www.openwall.com/lists/oss-security/2011/06/24/6

So, the total io = io with the network + io with privileged parent.


Thanks,

-- 
Vasiliy Kulikov
http://www.openwall.com - bringing security into open computing environments