lkml.org 
[lkml]   [2004]   [Sep]   [9]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: Q about pagecache data never written to disk
    Hi!

    > >>No, read() will see the modified pagecache data immediately, apart from
    > >>CPU
    > >>cache coherency effects.
    > >
    > >
    > >Is not this quite a big security hole?
    > >
    > >cat evil_data > /tmp/sign.me [Okay, evil_data probably have to
    > > contain lot of zeroes?]
    > >sync, fill disk or wait for someone to fill disk completely
    > >
    > >attempt to write good_data to /tmp/sign.me using mmap
    > >
    > >"Hey, root, see what /tmp/sign.me contains, can you make it suid?"
    > >
    > >root reads /tmp/sign.me, and sees it is good.
    > >
    > >root does chown root.root /tmp/sign.me; chmod 4755 /tmp/sign.me
    > >
    > >kernel realizes that there's not enough disk space, and discard
    > >changes, therefore /tmp/sign.me reverts to previous, evil, content.
    > >
    >
    > root would have to make that change while user has the file open,
    > and should welcome the subsequent unleashing of evil content as a
    > valuable lesson.

    Really? I thought that writeback is not synchronous at close()
    time.... Hmm.... It probably could be in case of mmap....

    It is still pretty unexpected. Like "root sees you have that file
    open, so he stops you via ptrace".... but ok....
    Pavel
    -
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.kernel.org
    More majordomo info at http://vger.kernel.org/majordomo-info.html
    Please read the FAQ at http://www.tux.org/lkml/

    \
     
     \ /
      Last update: 2005-03-22 14:06    [W:0.033 / U:0.660 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site