lkml.org 
[lkml]   [2018]   [Apr]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    SubjectRe: [PATCH 7/9] Pmalloc Rare Write: modify selected pools
    From
    Date


    On 4/24/18 4:44 PM, Matthew Wilcox wrote:
    > On Tue, Apr 24, 2018 at 02:32:36PM +0200, lazytyped wrote:
    >> On 4/24/18 1:50 PM, Matthew Wilcox wrote:
    >>> struct modifiable_data {
    >>> struct immutable_data *d;
    >>> ...
    >>> };
    >>>
    >>> Then allocate a new pool, change d and destroy the old pool.
    >> With the above, you have just shifted the target of the arbitrary write
    >> from the immutable data itself to the pointer to the immutable data, so
    >> got no security benefit.
    > There's always a pointer to the immutable data. How do you currently
    > get to the selinux context? file->f_security. You can't make 'file'
    > immutable, so file->f_security is the target of the arbitrary write.
    > All you can do is make life harder, and reduce the size of the target.

    So why adding an extra pointer/indirection helps here? It adds attacking
    surface.
    >
    >> The goal of the patch is to reduce the window when stuff is writeable,
    >> so that an arbitrary write is likely to hit the time when data is read-only.
    > Yes, reducing the size of the target in time as well as bytes. This patch
    > gives attackers a great roadmap (maybe even gadget) to unprotecting
    > a pool.

    I don't think this is relevant to the threat model this patch addresses.
    If the attacker can already execute code, it doesn't matter whether this
    specific piece of code exists or not. In general, if an attacker got to
    the point of using gadgets, you've lost.

    On the contrary, it opens the road to design trusted paths that can
    write to or access data that would generally be read-only or not
    accessible (with, of course, all the complexity, limitations and
    penalties of doing this purely in software on a page sized basis).


                -   Enrico




    \
     
     \ /
      Last update: 2018-04-24 17:04    [W:3.765 / U:0.088 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site