Re: Q about pagecache data never written to disk

[Nick Piggin <nickpiggin@yahoo.com.au>]

Pavel Machek wrote:

>>No, read() will see the modified pagecache data immediately, apart from CPU
>>cache coherency effects.
> 
> 
> Is not this quite a big security hole?
> 
> cat evil_data > /tmp/sign.me   [Okay, evil_data probably have to
> 				contain lot of zeroes?]
> sync, fill disk or wait for someone to fill disk completely
> 
> attempt to write good_data to /tmp/sign.me using mmap
> 
> "Hey, root, see what /tmp/sign.me contains, can you make it suid?"
> 
> root reads /tmp/sign.me, and sees it is good.
> 
> root does chown root.root /tmp/sign.me; chmod 4755 /tmp/sign.me
> 
> kernel realizes that there's not enough disk space, and discard
> changes, therefore /tmp/sign.me reverts to previous, evil, content.
> 

root would have to make that change while user has the file open,
and should welcome the subsequent unleashing of evil content as a
valuable lesson.