From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751590AbdGLXwE (ORCPT ); Wed, 12 Jul 2017 19:52:04 -0400 Received: from www.llwyncelyn.cymru ([82.70.14.225]:47220 "EHLO fuzix.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750821AbdGLXwC (ORCPT ); Wed, 12 Jul 2017 19:52:02 -0400 Date: Thu, 13 Jul 2017 00:50:54 +0100 From: Alan Cox To: Linus Torvalds Cc: Kees Cook , Andy Lutomirski , Michal Hocko , Ben Hutchings , Willy Tarreau , Hugh Dickins , Oleg Nesterov , "Jason A. Donenfeld" , Rik van Riel , Larry Woodman , "Kirill A. Shutemov" , Tony Luck , "James E.J. Bottomley" , Helge Diller , James Hogan , Laura Abbott , Greg KH , "security@kernel.org" , Qualys Security Advisory , LKML , Ximin Luo Subject: Re: [RFC][PATCH] exec: Use init rlimits for setuid exec Message-ID: <20170713003658.70b98278@alans-desktop> In-Reply-To: References: <20170706043235.GA36170@beast> Organization: Intel Corporation X-Mailer: Claws Mail 3.14.1 (GTK+ 2.24.31; x86_64-redhat-linux-gnu) MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org > (a) minimal: just use our existing default stack (and stack _only_) > limit value for suid binaries that actually get extra permissions: { > _STK_LIM, RLIM_INFINITY }. Even that is dangerous because a setuid binary can be transitioning between two users (none privileged) yet be subject to an rlimit attack. There's even less reason to believe that non root setuid binaries are properly hardened than obvious targets. CPU limit attacks in particular can be used to do some quite clever things. Also consider a binary that is gaining some minor right (eg network rights) being targetted because giving it extra permissions allows the attacker to gain access to infinite resources when that clearly isn't the intent. > (c) perhaps encourage people to annotate their suid binaries with > initial resource requirements (and for stack, I mean the existing > GNU_STACK ELF annotation in particular). Making this for setuid binaries only makes no sense. If a user can annotate required resources and the execve() fails if those resources are over the rlimit then that is a useful feature full stop, and there's no reason to even make it setuid dependent. Alan