Re: [patch 7/8] fdmap v2 - implement sys_socket2

[Ulrich Drepper <drepper@redhat.com>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Al Viro wrote:
> Any real-world examples of exploitable holes based on that?

Return to libc exploit, calling dup2, where some privileged data is
redirected from the normal file descriptor to one of the attackers
choosing.  The latter could be an outgoing socket connection which would
result in leaking the data to the outside.

         normal code                         intruder

                                          so = socket()

    fd = open ("local-file")

                                          dup2(so, fd);

    write (fd, privileged data)


It's just a little function call.  If the arguments of dup2() are known
this is not a big issue to construct.



>> You're confusing the problems.
> 
> No, I'm not.  The entire argument for having a separate set of descriptors
> is based on programs behaving in similar fashion, working correctly now but
> limiting what libraries can do with opening files for internal needs.

It's completely different.

The reason why runtime libraries cannot keep descriptors open unless it
is explicitly part of the API (e.g., opendir) is that POSIX and Unix
forever guarantee that descriptors are allocated sequentially.  Linus
already showed a code sequence:

	close(0);
	.. something else ..
	if (open("myfile", O_RDONLY) < 0)
		exit(1);

This occurs in the real world and it is guaranteed to work.

- --
➧ Ulrich Drepper ➧ Red Hat, Inc. ➧ 444 Castro St ➧ Mountain View, CA ❖
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (GNU/Linux)

iD8DBQFGagv72ijCOnn/RHQRAqxTAJwLhjuFT22SegEVXrbevpsnOkDxLQCgwgza
7ZOScxEm2lgMJNjG9UDAdfo=
=fenl
-----END PGP SIGNATURE-----