Re: [RFC/PATCH] revoke/frevoke system calls V2

[daw@cs.berkeley.edu (David Wagner)]

Edgar Toernig  wrote:
>Your implementation is much cruder - it simply takes the fd
>away from the app; any future use gives EBADF.  As a bonus,
>it works for regular files and even goes as far as destroying
>all mappings of the file from all processes (even root processes).
>IMVHO this is a disaster from a security and reliability point
>of view.

I'm still trying to understand the semantics of this proposed
frevoke() implementation.  Can an attacker use this to forcibly
close some other processes' file descriptor?  Suppose the target
process has fd 0 open and the attacker revokes the file corresponding
to fd 0; what is the state of fd 0 in the target process?  Is it
closed?  If the target process then open()s another file, does it
get bound to fd 0?  (Recall that open() always binds to the lowest
unused fd.)  If the answers are "yes", then the security consequences
seem very scary.

For example, suppose that the attacker opens some file onto fd 2,
forks and execs /bin/login (say), and revokes that fd while /bin/login
is in the middle of executing.  Can this cause horrible catastrophes?
Note that, to defend against stderr attacks, some setuid programs will
forcibly open /dev/zero three times to make sure that fds 0, 1, and
2 are open, so that opening some later file (e.g., /etc/passwd)
doesn't inadvertently get attached to fd 2.  If some other process
can forcibly close /bin/login's fd 2, then that's very bad.

Can something like the following happen?

    Attacker                /bin/login
    --------                ----------
    open("foo") -> 2
    fork()
    exec("/bin/login")
                            open("/dev/zero") -> 3
                            open("/dev/zero") -> 4
                            open("/dev/zero") -> 5
    frevoke(2)
                            open("/etc/passwd") -> 2
                            ...
                            perror("wrong password")   # Corrupts /etc/passwd!


/* A hypothetical implementation of /bin/login: */
int main() {
    // Protect ourselves from stderr attacks
    int ignore;
    ignore = open("/dev/zero");
    ignore = open("/dev/zero");
    ignore = open("/dev/zero");

    int pwfd;
    pwfd = open("/etc/passwd", O_RDWR);
    ...
    if (!correctpassword(uname, pass)) {
        perror("wrong password");
        exit(1);
    }
    ...
}