Re: Security exploit in shmfs?

From: Christoph Rohland (hans-christoph.rohland@sap.com)
Date: Thu Mar 16 2000 - 12:42:42 EST


Hi Linus,

I know you did not like my first version, but what do you think about
this patch? Is it acceptable?

It resolves many of the problems we have with the shm fs code: It
works in a chrooted environment without playing with the root
directory, does not need shm_path and also no ugly trick to get it on
the fly.

It is against 99-pre1. I can add Alans stuff to make the shmat on
removed segments later.

Richard Gooch <rgooch@atnf.csiro.au> writes:
> Hi, all. It looks like there is a potential security hole in the new
> shmfs code. In ipc/shm.c:sys_shmat() the root directory is temporarily
> changed for a while. A CLONE_FS clone can then come in and take
> advantage of this exposure. This needs to be fixed.
> This is in 2.3.99-pre2.
>
> Frankly, I'd rather see the old SysV IPC code restored, especially
> since we're so close to 2.4. At least it's a known quantity.

Richard, during the whole 2.3 cycle I did test the shm code. It was
never as stable as it is today. And posix shm is something we should
really have.

Greetings
                Christoph



-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/



This archive was generated by hypermail 2b29 : Thu Mar 23 2000 - 21:00:22 EST