Re: [ANNOUNCE] Release Digsig 1.3.1: kernel module for run-time authentication of binaries

[Makan Pourzandi <Makan.Pourzandi@ericsson.com>]

Hi all,

see below:

Chris Wright wrote:
> * Makan Pourzandi (Makan.Pourzandi@ericsson.com) wrote:
> 
>>Serge E. Hallyn wrote:
>>
>>>Quoting Chris Wright (chrisw@osdl.org):
>>>
>>>>AFAICT, this means anybody with read access to a file can block all
>>>>writes.  This doesn't sound great.
>>>
>>>True.
>>
>>>This could be fixed by adding a check at the top of dsi_file_mmap for
>>>file->f_dentry->d_inode->i_mode & MAY_EXEC.  Of course then shared
>>>libraries which are installed without execute permissions will cause
>>>apps to break.  On my quick test, I couldn't run xterm or vi  :)
>>>
>>>Note that blocking writes requires that the file be a valid ELF file,
>>>as this is all that digsig mediates.  So I'm not sure which we worry
>>>about more - the fact that all shared libraries have to be installed
>>>with execute permissions (under the proposed solution), or that write
>>
>>
>>My 2 cents, a quick browsing on my machine (fedora core 1) shows that 
>>almost all my shared libraries are installed with both execution and 
>>read permissions.  IMHO, I don't believe then that this should be 
>>considered as a major issue.
> 
> 
> This has nothing to do with file permissions aside of read.  All you need
> is read permission, then you can mmap(PROT_EXEC) which will kick off the
> check, and do deny_write_access.  It's a freeform way to lock writers
> out of any readable file in the system.  This is why MAP_EXECUTABLE and
> MAP_DENYWRITE are masked off at syscall entry.

Chris, my understanding is that Serge's patch even though it restricts a 
little the system admin, is the best solution we have for time being. Am 
I right?
If this is the case I'll include Serge's patch in the cvs source code 
and send out a new release soon.

regards,
Makan
> 
> thanks,
> -chris

-- 

Makan Pourzandi, Open Systems Lab
Ericsson Research, Montreal, Canada
*This email does not represent or express the opinions of Ericsson Inc.*