[lkml]   [1999]   [Dec]   [27]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
Subjectstrace can lie

When you see snippet from strace, that says:

open("/etc/passwd", O_RDONLY) = 3

Do you trust it? You should not.

Malicious program could open _any_ file on filesystem with this
syscall. Here is example of such malicious program:

char *c = 0x94000000;
open( "/tmp/delme", O_RDWR );
mmap( c, 4096, PROT_READ | PROT_WRITE, MAP_FIXED | MAP_SHARED, 3, 0);
*c = 0;
if (fork()) {
while(1) {
strcpy( c, "/public" );
strcpy( c, "/secret" );
} else
while (1)
open( c, 0 );

Depending on races, /public or /secret is printed with strace. This
can be reproduced even on UP and easiest way to do so is to make
/public file readable, and then look if you get

[pid 224] open("/public", O_RDONLY) = 718
[pid 224] open("/secret", O_RDONLY) = 719
[pid 224] open("/public", O_RDONLY) = 720

snippet like this. It is impossible for kernel to open non-existent
file; that means that strace printed something that did not actually

Any ideas how to get rid of this problem? It is nasty. It is very
nasty and makes strace unusable for anything security-sensitive.
PS: You don't need two processes sharing memory. Memory-mapped file
will do the job. This was just illustration.
I'm "In my country we have almost anarchy and I don't care."
Panos Katsaloulis describing me w.r.t. patents me at

To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to
Please read the FAQ at

 \ /
  Last update: 2005-03-22 13:55    [W:0.053 / U:0.636 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site