From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-0.7 required=3.0 tests=HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id E4DCEC3A59E for ; Mon, 2 Sep 2019 17:57:43 +0000 (UTC) Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id B5D38216C8 for ; Mon, 2 Sep 2019 17:57:43 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org B5D38216C8 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=polymtl.ca Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org Received: from localhost ([::1]:38982 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1i4qaE-0007rQ-Sl for qemu-devel@archiver.kernel.org; Mon, 02 Sep 2019 13:57:42 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]:33516) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1i4qHg-0004SF-Es for qemu-devel@nongnu.org; Mon, 02 Sep 2019 13:38:33 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1i4qHf-0002vN-5c for qemu-devel@nongnu.org; Mon, 02 Sep 2019 13:38:32 -0400 Received: from smtp.polymtl.ca ([132.207.4.11]:40681) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1i4qHf-0002lU-1D for qemu-devel@nongnu.org; Mon, 02 Sep 2019 13:38:31 -0400 Received: from elsa (modemcable059.101-200-24.mc.videotron.ca [24.200.101.59]) by smtp.polymtl.ca (8.14.7/8.14.7) with ESMTP id x82HahMQ030201 (version=TLSv1/SSLv3 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 2 Sep 2019 13:36:48 -0400 DKIM-Filter: OpenDKIM Filter v2.11.0 smtp.polymtl.ca x82HahMQ030201 References: <20190807135458.32440-1-dion@linutronix.de> <20190807135458.32440-2-dion@linutronix.de> <7a8fa9b4-01b5-e431-be89-00e73235e3ff@vivier.eu> From: Olivier Dion To: Laurent Vivier In-reply-to: <7a8fa9b4-01b5-e431-be89-00e73235e3ff@vivier.eu> Date: Mon, 02 Sep 2019 13:36:56 -0400 Message-ID: <875zmaeh1j.fsf@polymtl.ca> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable X-Poly-FromMTA: (modemcable059.101-200-24.mc.videotron.ca [24.200.101.59]) at Mon, 2 Sep 2019 17:36:43 +0000 X-detected-operating-system: by eggs.gnu.org: Genre and OS details not recognized. X-Received-From: 132.207.4.11 X-Mailman-Approved-At: Mon, 02 Sep 2019 13:56:52 -0400 Subject: Re: [Qemu-devel] [PATCH 1/1] linux-user: Handle /proc/self/exe in syscall execve X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: qemu-devel@nongnu.org, john.ogness@linutronix.de Errors-To: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org Sender: "Qemu-devel" On 2019-08-23T12:58:43-0400, Laurent Vivier wrote: > Le 07/08/2019 =C3=A0 15:54, dion@linutronix.de a =C3=A9crit : > > From: Olivier Dion > > > > If not handled, QEMU will execve itself instead of the emulated > > process. This could result in potential security risk. > > > Could you explain what you mean by potential security risk? I don't have any exploit in mind, but someone motivated enough could certainly find one. For example, it's possible to ask qemu static to execute another program. The main point is that an emulator should never leak informations to its environnement. If the emulated program can determine that it is being emulated, other than by an "official" way, then the emulator is at fault. --=20 Olivier Dion Polymtl