lkml.org 
[lkml]   [2001]   [May]   [25]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
SubjectRe: PATCH: "Kernel Insider" (security optimization)
Date
>Its a linux kernel modification, that allows to decide wich uid, pid or
>file can open a tcp socket in listening state.

- Putting access control on listen() [rather than socket()/bind()]
seems like a really bad idea. In particular, in some cases one can
bind to a port and receive messages on it without ever calling listen(),
if I am not mistaken.

- The use of sock_i_uid(sock) seems poorly chosen; if sock->socket==NULL,
then your module will mistakenly think that the action was requested by
uid 0. In general, the return value from sock_i_uid() cannot be trusted
for permission checks for several reasons. Why don't you simply use
current->euid for your permission checks?

- Checking pid's doesn't seem like a good idea. If a process listed in
allowed_pids dies, then some other malicious process can wrap the pid
space and take over that trusted pid, thereby subverting your access
control policy.

- Are you aware of previous work on this subject? In particular, you
might enjoy checking out the Janus project, which is a much more general
implementation of this idea: http://www.cs.berkeley.edu/~daw/janus/

- You should really join the mailing list hosted by Crispin Cowan working
to develop kernel hooks for this sort of kernel security modification.
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 12:53    [W:0.039 / U:0.408 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site