Re: [ANNOUNCE] Release Digsig 1.3.1: kernel module for run-time authentication of binaries

Chris Wright
2004-09-09T17:52:32Z

* Serge E. Hallyn (serue@us.ibm.com) wrote:
> > > - support to avoid vulnerability for rewrite of shared
> > > libraries
> >
> > Could you elaborate on this one?
>
> When a file is being executed, deny_write_access(file) is called to
> prevent writing until execution completes. Because deny_write_access
> is not exported from fs/namei.c, we emulate this behavior for shared
> libraries.

Hmm, ok, so you're relying on the loader to do PROT_EXEC mmaps for
shared libraries? Probably not required at least on x86. Also, does
this work when executing loader directly (/lib/ld.so /bin/ps), and with
dlopen?

> > > Future works
> > > =============
> > >
> > > - improving the caching and revocation: it is currently tested
> > > and will be sent out soon after stability testing
> >
> > Should be helpful enough to cache result until thing's opened for
> > writing, or is that what you're doing now?
>
> Exactly. When the file is opened for writing (which as much as possible
> requires the file to not be executed), we uncache the signature
> validation.
>
> (The new patch hashes revocations (they were on a linked list), and
> steals the seqlock-based structure Rik van Riel had suggested for
> the selinux avc cache for use in the signature revocation cache. There
> is no change in functionality, only (hopefully) performance improvements.)

Ok, I see. Makes sense.

thanks,
-chris
--
Linux Security Modules http://lsm.immunix.org http://lsm.bkbits.net