Messages in this thread | | | Subject | Re: System call audit | From | David Woodhouse <> | Date | Tue, 13 May 2008 13:59:50 +0100 |
| |
On Tue, 2008-05-13 at 08:51 -0400, Mathieu Desnoyers wrote: > * David Woodhouse (dwmw2@infradead.org) wrote: > > On Mon, 2008-05-12 at 20:06 -0400, Mathieu Desnoyers wrote: > > > Hi David, > > > > > > As I am looking into the system-wide system call tracing problem, I > > > start to wonder how auditsc deals with the fact that user-space could > > > concurrently change the content referred to by the __user pointers. > > > > In general we have to copy the content into kernel space, audit it, and > > then act on it from there. See the explanation on the IPC audit patch at > > http://lwn.net/Articles/125350/ for example. > > > > Auditing one thing and then acting on another would be simply broken. > > > > > This would be the case for execve. If we create a program with two > > > thread; one is executing execve syscalls and the other thread would be > > > modifying the userspace string containing the name of the program to > > > execute. > > > > I was going to suggest that that attack vector won't work, because > > execve() kills all threads. But all you have to do to avoid that is put > > the data in question into a shared writable mmap and modify it from > > another _process_. And in fact I suspect there's a combination of CLONE_ > > flags which would avoid the thread-killing behaviour anyway. > > > > Even better : if execve fails, it doesn't kill the threads. Therefore, > all we have to do is to busy-loop doing failing execve() calls and > atomically change the string to what we want to be executed. Can anyone > test the sample snippet in a context where executing /bin/bash is > disallowed on a SMP system ? I don't have a selinux setup handy.
You were talking about audit earlier. Now you seem to be talking about selinux.
-- dwmw2
| |