From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932986AbXIFXdR (ORCPT ); Thu, 6 Sep 2007 19:33:17 -0400 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S932599AbXIFXdG (ORCPT ); Thu, 6 Sep 2007 19:33:06 -0400 Received: from pat.uio.no ([129.240.10.15]:47219 "EHLO pat.uio.no" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932566AbXIFXdD (ORCPT ); Thu, 6 Sep 2007 19:33:03 -0400 Subject: Re: NFS4 authentification / fsuid From: Trond Myklebust To: "J. Bruce Fields" Cc: Satyam Sharma , Jan Engelhardt , Linux Kernel Mailing List In-Reply-To: <1189120910.6672.30.camel@heimdal.trondhjem.org> References: <1188484155.6755.38.camel@heimdal.trondhjem.org> <1188484337.6755.41.camel@heimdal.trondhjem.org> <1188486240.6755.51.camel@heimdal.trondhjem.org> <20070830214431.GF10808@fieldses.org> <20070906151118.GB28565@fieldses.org> <1189120910.6672.30.camel@heimdal.trondhjem.org> Content-Type: text/plain Date: Fri, 07 Sep 2007 01:32:52 +0200 Message-Id: <1189121572.6672.36.camel@heimdal.trondhjem.org> Mime-Version: 1.0 X-Mailer: Evolution 2.10.1 Content-Transfer-Encoding: 7bit X-UiO-Resend: resent X-UiO-Spam-info: not spam, SpamAssassin (score=0.0, required=12.0, autolearn=disabled, none) X-UiO-Scanned: 8732DF53D97E31DCF91784F705B6B22D65A02245 X-UiO-SPAM-Test: remote_host: 129.240.10.9 spam_score: 0 maxlevel 200 minaction 2 bait 0 mail/h: 150 total 3719421 max/h 8345 blacklist 0 greylist 0 ratelimit 0 Sender: linux-kernel-owner@vger.kernel.org X-Mailing-List: linux-kernel@vger.kernel.org On Fri, 2007-09-07 at 01:21 +0200, Trond Myklebust wrote: > On Thu, 2007-09-06 at 11:11 -0400, J. Bruce Fields wrote: > > On Thu, Sep 06, 2007 at 01:59:50PM +0530, Satyam Sharma wrote: > > > Oh and btw, note that we're talking of the (lack of) security of a > > > "running kernel" here -- because across reboots, there is /really/ > > > *absolutely* no such thing as "kernelspace security" because the superuser > > > will simply switch the vmlinuz itself ... > > > > Well, the machine could be booting from cdrom, and could live in a > > locked machine room. Or people with root on a virtual host don't > > necessarily have the ability to replace the kernel for that host. > > mount -t tmpfs none /my_tmpfs > cd /my_tmpfs > cp -a /bin bin > cp -p my_keylogging_pam_module.so lib > pivot_root . /old-root Sorry. Of course, you have to copy the entire /lib, etc. onto the tmpfs, but you get the gist.... The point is that it is easy to subvert userspace if you have enough privileges. In the above example it may not be entirely undetectable, but who here is running a script on every login to check that / is indeed uncompromised? Trond