Re: [PATCH] sysctl: control functionality of /proc/pid/mem

[Ingo Molnar]

* Kees Cook <keescook@xxxxxxxxxxxx> wrote:

> @@ -702,6 +704,9 @@ static int mem_open(struct inode* inode, struct file* file)
>  	struct task_struct *task = get_proc_task(file->f_path.dentry->d_inode);
>  	struct mm_struct *mm;
>  
> +	if (sysctl_proc_pid_mem < 1)
> +		return -EACCES;

This looks like an unprivileged user-space triggerable memory 
leak DoS. The task reference is already acquired at that point.

See how easy it is to introduce bugs with potential security 
side-effects, even when the intention is to increase security?
:-)

( Btw., this is why i generally prefer 'invariant' local
  variable definition blocks that have no serious side effects -
  it makes the flow more obvious. Local variables slip off the 
  eye rather often and don't register as 'real' code.)

Thanks,

	Ingo
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/