Messages in this thread | | | From | Nikita Danilov <> | Date | Mon, 28 Nov 2005 15:46:18 +0300 | Subject | Re: What's wrong with this really simple function? |
| |
Juergen Quade writes: > On Sun, Nov 27, 2005 at 12:57:47PM -0600, Mohamed El Dawy wrote: > > Hi, > > I have created this 5-liner system call, which basically opens a > > file, write "Hello World" to it, and then returns. That's all. > > > > Now, when I actually call it, it creates the file successfully but > > writes nothing to it. The file is created and is only zero bytes. So, > > either write didn't write, or close didn't close. Any help would be > > greatly appreciated. > > ... > > The following (module-) code will create and write a file from > inside a kernel. Ok -- you know -- you should not use it > without really good reasons ... > > Juergen. > > #include <linux/module.h> > #include <linux/moduleparam.h> > #include <linux/fs.h> > #include <asm/uaccess.h> > > static char filename[255]; > module_param_string( filename, filename, sizeof(filename), 666 ); > struct file *log_file; > > static int __init mod_init(void) > { > mm_segment_t oldfs; > > if( filename[0]=='\0' ) > strncpy( filename, "/tmp/kernel_file", sizeof(filename) ); > printk("opening filename: %s\n", filename); > log_file = filp_open( filename, O_WRONLY | O_CREAT, 0644 ); > printk("log_file: %p\n", log_file ); > if( IS_ERR( log_file ) ) > return -EIO;
This code is trivially exploitable: /tmp is usually a world-writable directory, and everybody can do
$ ln -s /etc/shadow /tmp/kernel_file
or even
$ ln /etc/shadow /tmp/kernel_file
provided that /tmp and /etc are on the same file system.
Please do not use it.
Nikita. - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |