lkml.org 
[lkml]   [2001]   [Oct]   [3]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
SubjectRe: Security question: "Text file busy" overwriting executables but not shared libraries?
From
Date
Rob Landley <landley@trommello.org> writes:

> On Wednesday 03 October 2001 14:06, Eric W. Biederman wrote:
>
> > > But not modify a busy executable.
> >
> > Have ld-linux.so set the MAP_DENYWRITE bit when it is mapping
> > the library.
>
> And of course since the FSF wrote it, it's not quite that simple...
>
> >/* The right way to map in the shared library files is MAP_COPY, which
> > makes a virtual copy of the data at the time of the mmap call; this
> > guarantees the mapped pages will be consistent even if the file is
> > overwritten. Some losing VM systems like Linux's lack MAP_COPY. All we
> > get is MAP_PRIVATE, which copies each page when it is modified; this
> > means if the file is overwritten, we may at some point get some pages
> > from the new version after starting with pages from the old version. */
>
> I.E. it seems like they go out of their way to ALLOW writing to the libaries.
> (I assume they KNOW the difference between MAP_DENYWRITE, MAP_COPY, and
> MAP_PRIVATE...?)
>
> This look right to anybody else? Or am I about to wander into weird
> side-effect land? (Is there a reason they DON'T want a read-only mapping?
> Are they writing data into those pages, perhaps doing the linking fixup
> stuff? What?)

You definentily need to do some writing to do the fixups.
The deny write solves the problem of somone potentially writing to the
file at a later date.
Probably what is needed is:

#ifndef MAP_COPY
# ifdef MAP_DENYWRITE
# define MAP_COPY (MAP_PRIVATE | MAP_DENYWRITE)
# else
# define MAP_COPY MAP_PRIVATE
# endif
#endif

>
> --- elf/dl-load.bak Wed Oct 3 18:53:37 2001
> +++ elf/dl-load.c Wed Oct 3 18:55:57 2001
> @@ -48,7 +48,7 @@
> means if the file is overwritten, we may at some point get some pages
> from the new version after starting with pages from the old version. */
> #ifndef MAP_COPY
> -# define MAP_COPY MAP_PRIVATE
> +# define MAP_COPY MAP_DENYWRITE
> #endif
>
> /* Some systems link their relocatable objects for another base address
>
> I should just try this and see what it does. On a machine I don't mind
> reinstalling from scratch. Which means I need to dig up a spare keyboard for
> my junk machine... (And figure out how to get glibc's ./configure script to
> realise that linuxthreads is, in fact, there in the source directory. It's
> right there. Use it. Don't yell at me it's not there. I didn't make this
> SRPM, I changed one line... Sigh...)
>
> In the morning...

For testing you can do ./ld-linux.so program to run a program under to
see if it actually works.

Eric

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 13:03    [W:0.176 / U:0.468 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site