Messages in this thread | | | Date | Fri, 24 Apr 2015 17:46:25 +0100 | Subject | Re: Regression: Requiring CAP_SYS_ADMIN for /proc/<pid>/pagemap causes application-level breakage | From | Mark Williamson <> |
| |
Hi Linus,
Thanks for responding so quickly!
On Fri, Apr 24, 2015 at 5:08 PM, Linus Torvalds <torvalds@linux-foundation.org> wrote: > So the one exception to the regression rule is "security fixes", but > even for security fixes we do try to be as reasonable as humanly > possible to make them not break things.
Understood - there are clear reasons something had to be done here.
> Now, as you mentioned, one option is to not outright disallow accesses > to the /proc/PID/pagemap, but to at least hide the page frame numbers. > However, I don't believe that we have a good enough scrambling model > to make that reasonable. Remember: any attacker will be able to see > our scrambling code, so it would need to be both cryptographically > secure *and* use a truly random per-VM secret key. Quite frankly, > that's a _lot_ of effort for dubious gain...
*nod*
> So the "just show physical addresses as zero for non-root users" > (instead of the outright ban on opening the file) is likely the only > really viable alternative. > > It sounds like that could work for you. So if you can modify the app > to do that, and send me a tested kernel patch that moves the > permission check into the read phase (remember to use the open-time > credentials in "file->f_cred" rather than the read-time credentials in > "current" - otherwise you can trick some suid program to read the fily > that an unauthorized user opened), then we can have this fixed. Does > that sound reasonable?
That sounds very reasonable, thank you! We'll cook up a patch and get back to you.
Thanks, Mark
| |