From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1757537AbZKMV0Y (ORCPT ); Fri, 13 Nov 2009 16:26:24 -0500 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S1756645AbZKMV0S (ORCPT ); Fri, 13 Nov 2009 16:26:18 -0500 Received: from mgw2.diku.dk ([130.225.96.92]:55783 "EHLO mgw2.diku.dk" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754987AbZKMV0R (ORCPT ); Fri, 13 Nov 2009 16:26:17 -0500 Date: Fri, 13 Nov 2009 22:26:20 +0100 (CET) From: Julia Lawall To: Valdis.Kletnieks@vt.edu Cc: Casey Schaufler , James Morris , "Serge E. Hallyn" , Stephen Smalley , Eric Paris , linux-kernel@vger.kernel.org, linux-security-module@vger.kernel.org, kernel-janitors@vger.kernel.org Subject: Re: [PATCH 3/4] security/selinux: decrement sizeof size in strncmp In-Reply-To: <19857.1258147396@turing-police.cc.vt.edu> Message-ID: References: <20091112145314.GA24682@us.ibm.com> <4AFC3620.2020809@schaufler-ca.com> <4AFCC06B.1030302@schaufler-ca.com> <19857.1258147396@turing-police.cc.vt.edu> MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Fri, 13 Nov 2009, Valdis.Kletnieks@vt.edu wrote: > On Thu, 12 Nov 2009 18:11:55 PST, Casey Schaufler said: > > James Morris wrote: > > > Do you see potential for a buffer overrun in this case? > > > No, but I hate arguing with people who think that every time > > they see strcmp that they have found a security flaw. > > How do you feel about people who think every time they see strcmp() > "Oh crap, something that needs auditing"? ;) > > The biggest problem with strcmp() is that even if it got audited when that code > went in, it's prone to unaudited breakage when somebody changes something in > some other piece of code, quite often in some other .c file in some other > directory. > > Julia, is there a way to use coccinelle to detect unsafe changes like that? Or > is expressing those semantics too difficult? Could you give a concrete example of something that would be a problem? If something like alias analysis is required, to know what strings a variable might be bound to, that might be difficult. Coccinelle works better when there is some concrete codeto match against. But it is possible to eg match functions that have a certain property of their return value, or to collect all of the values that are stored in a structure field. julia