lkml.org 
[lkml]   [2017]   [Jul]   [5]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    From
    Date
    SubjectRe: [PATCH] mm: larger stack guard gap, between vmas
    On Wed, Jul 5, 2017 at 5:19 PM, Andy Lutomirski <luto@kernel.org> wrote:
    > On Wed, Jul 5, 2017 at 4:50 PM, Kees Cook <keescook@chromium.org> wrote:
    >> As part of that should we put restrictions on the environment of
    >> set*id exec too? Part of the risks demonstrated by Qualys was that
    >> allowing a privilege-elevating binary to inherit rlimits can have lead
    >> to the nasty memory layout side-effects. That would fall into the
    >> "hardening" bucket as well. And if it turns out there is some set*id
    >> binary out there that can't run with "only", e.g., 128MB of stack, we
    >> can make it configurable...
    >
    > Yes. I think it's ridiculous that you can change rlimits and then
    > exec a setuid thing. It's not so easy to fix, though. Maybe track,
    > per-task, inherited by clone and exec, what the rlimits were the last
    > time the process had privilege and reset to those limits when running
    > something setuid. But a better approach might be to have some sysctls
    > that say what the rlimits become when doing setuid.
    >
    > We need per-user-ns sysctls for stuff like this, and we don't really
    > have them...

    In userspace, the way that sensible rlimit defaults were selected by
    PAM when building an initial environment is to just examine the
    rlimits of init. Maybe we could just do the same thing here, which
    gives us some level of namespace control.

    -Kees

    --
    Kees Cook
    Pixel Security

    \
     
     \ /
      Last update: 2017-07-06 04:46    [W:4.073 / U:0.628 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site