Re: [ANNOUNCE] Release Digsig 1.3.1: kernel module for run-time authentication of binaries

Makan Pourzandi
2004-09-10T21:02:05Z

Hi all,

see below:

Chris Wright wrote:
> * Makan Pourzandi (Makan.Pourzandi@ericsson.com) wrote:
>
>>Serge E. Hallyn wrote:
>>
>>>Quoting Chris Wright (chrisw@osdl.org):
>>>
>>>>AFAICT, this means anybody with read access to a file can block all
>>>>writes. This doesn't sound great.
>>>
>>>True.
>>
>>>This could be fixed by adding a check at the top of dsi_file_mmap for
>>>file->f_dentry->d_inode->i_mode & MAY_EXEC. Of course then shared
>>>libraries which are installed without execute permissions will cause
>>>apps to break. On my quick test, I couldn't run xterm or vi :)
>>>
>>>Note that blocking writes requires that the file be a valid ELF file,
>>>as this is all that digsig mediates. So I'm not sure which we worry
>>>about more - the fact that all shared libraries have to be installed
>>>with execute permissions (under the proposed solution), or that write
>>
>>
>>My 2 cents, a quick browsing on my machine (fedora core 1) shows that
>>almost all my shared libraries are installed with both execution and
>>read permissions. IMHO, I don't believe then that this should be
>>considered as a major issue.
>
>
> This has nothing to do with file permissions aside of read. All you need
> is read permission, then you can mmap(PROT_EXEC) which will kick off the
> check, and do deny_write_access. It's a freeform way to lock writers
> out of any readable file in the system. This is why MAP_EXECUTABLE and
> MAP_DENYWRITE are masked off at syscall entry.

Chris, my understanding is that Serge's patch even though it restricts a
little the system admin, is the best solution we have for time being. Am
I right?
If this is the case I'll include Serge's patch in the cvs source code
and send out a new release soon.

regards,
Makan
>
> thanks,
> -chris

--

Makan Pourzandi, Open Systems Lab
Ericsson Research, Montreal, Canada
*This email does not represent or express the opinions of Ericsson Inc.*