Messages in this thread | | | Subject | Re: [kernel-hardening] Re: [PATCH 0/3] exec: Pin stack limit during exec | From | David Windsor <> | Date | Fri, 19 Jan 2018 20:12:40 -0500 |
| |
I have some spare cycles; is there any more relevant information outside of this thread?
Thanks, David
> On Jan 19, 2018, at 5:49 PM, Kees Cook <keescook@chromium.org> wrote: > >> On Tue, Jan 9, 2018 at 12:23 PM, Kees Cook <keescook@chromium.org> wrote: >> Attempts to solve problems with the stack limit changing during exec >> continue to be frustrated[1][2]. In addition to the specific issues >> around the Stack Clash family of flaws, Andy Lutomirski pointed out[3] >> other places during exec where the stack limit is used and is assumed >> to be unchanging. Given the many places it gets used and the fact that >> it can be manipulated/raced via setrlimit() and prlimit(), I think the >> only way to handle this is to move away from the "current" view of the >> stack limit and instead attach it to the bprm, and plumb this down into >> the functions that need to know the stack limits. This series implements >> the approach. I'd be curious to hear feedback on alternatives. > > Friendly ping -- looking for some people with spare cycles to look > this over. If people want, I can toss it into -next as part of my kspp > tree. It's been living happily in 0-day for 2 weeks... > > Thanks! > > -Kees > >> [1] 04e35f4495dd ("exec: avoid RLIMIT_STACK races with prlimit()") >> [2] 779f4e1c6c7c ("Revert "exec: avoid RLIMIT_STACK races with prlimit()"") >> [3] to security@kernel.org, "Subject: existing rlimit races?" > > -- > Kees Cook > Pixel Security
| |