[lkml]   [2004]   [Sep]   [9]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: Q about pagecache data never written to disk

> >>No, read() will see the modified pagecache data immediately, apart from
> >>CPU
> >>cache coherency effects.
> >
> >
> >Is not this quite a big security hole?
> >
> >cat evil_data > /tmp/ [Okay, evil_data probably have to
> > contain lot of zeroes?]
> >sync, fill disk or wait for someone to fill disk completely
> >
> >attempt to write good_data to /tmp/ using mmap
> >
> >"Hey, root, see what /tmp/ contains, can you make it suid?"
> >
> >root reads /tmp/, and sees it is good.
> >
> >root does chown root.root /tmp/; chmod 4755 /tmp/
> >
> >kernel realizes that there's not enough disk space, and discard
> >changes, therefore /tmp/ reverts to previous, evil, content.
> >
> root would have to make that change while user has the file open,
> and should welcome the subsequent unleashing of evil content as a
> valuable lesson.

Really? I thought that writeback is not synchronous at close()
time.... Hmm.... It probably could be in case of mmap....

It is still pretty unexpected. Like "root sees you have that file
open, so he stops you via ptrace".... but ok....
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to
More majordomo info at
Please read the FAQ at

 \ /
  Last update: 2005-03-22 14:06    [W:0.055 / U:2.068 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site