[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-Id: <201103140937.51078.sgrubb@redhat.com>
Date: Mon, 14 Mar 2011 09:37:50 -0400
From: Steve Grubb <sgrubb@...hat.com>
To: oss-security@...ts.openwall.com
Cc: Ludwig Nussel <ludwig.nussel@...e.de>
Subject: Re: Untrusted fs and invalid filenames
On Monday, March 14, 2011 09:28:59 am Ludwig Nussel wrote:
> Stephan Mueller wrote:
> > Am Samstag, 12. März 2011, um 18:03:45 schrieb Vasiliy Kulikov:
> > > What I suggest is something like "-o untrusted" option to mount. This
> > > would mean that the system considers the input from such fs as a
> > > malicious input. Such mounted fs would try to consider the data on
> > > disk as untrusted and to be as robust as possible, e.g. check against
> > > "/"-filenames, against corrupted fs structures, etc. I'd be happy to
> > > hear opinions about the usefulness of this feature.
> >
> > I completely second your concerns.
> >
> > However, how do you propose to implement that "untrusted" option? The
> > core problem IMHO is that the physical layout and structure in a file
> > system is assumed to be correct in general by the kernel. The physical
> > file system implementations (including any depending code, like the LSMs
> > for interpreting XATTRs) have some checks for an input validation. But I
> > highly doubt that all checks necessary for an untrusted file system
> > layout are implemented - to have all such checks would cause some speed
> > penalties nobody wants to carry.
>
> For the hot plugged USB drive case speed of the file system
> shouldn't be much of a concern. I wonder whether it would be
> possible to create a wrapper API that allow to compile kernel fs
> modules as user space programs for use with e.g. fuse.
I think you lose auditing in that case.
I'm still thinking improving fsck is the best solution. The kernel can be hardened.
That is what tools like fsfuzz can help with. But in the case where the drive is
otherwise fine, but some unexpected characters are in otherwise legal directory
structure is something unexpected. Normally the kernel prevents certain sequences, but
if the fs has been modified through a different technique, then the kernel was not able
to prevent these modifications. All scripts and programs depend on the kernel making
sure this never happened.
-Steve
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
