oss-sec mailing list archives
Re: [patch] proc.5: tell how to parse /proc/*/stat correctly
From: Solar Designer <solar () openwall com>
Date: Sat, 31 Dec 2022 18:27:58 +0100
Hi all, Let's wind this oss-security thread down as it relates to brainstorming and commenting on totally new designs - no more of that, please. Many things were said, but realistically the interface isn't _that_ broken (this can be parsed correctly, and procps-ng manages to) and is (hopefully) not going to change much (in my opinion, and I know I'm not alone in this, most of the proposals would make things worse overall). Somewhat realistically, one possible change is replacing the most risky characters, such as braces and anything <= ASCII 32, perhaps with '?' to match what procps-ng is doing. Perhaps do this either on all updates of "comm" or in all places where "comm" is reported to userspace (including procfs and kernel messages, by calling a common function). "comm" isn't the full process name anyway - it's often truncated - so it can reasonably be made safer in other ways as well. As an option, the replacing of whitespace (ASCII 32) and braces could be limited to the "stat" file, but the control characters are (even more) problematic with other interfaces where "comm" is exposed, so replacing them should probably be global. Happy New Year! Alexander
Current thread:
- Re: [patch] proc.5: tell how to parse /proc/*/stat correctly, (continued)
- Re: [patch] proc.5: tell how to parse /proc/*/stat correctly Alejandro Colomar (Dec 28)
- Re: [patch] proc.5: tell how to parse /proc/*/stat correctly Theodore Ts'o (Dec 29)
- Re: [patch] proc.5: tell how to parse /proc/*/stat correctly Demi Marie Obenour (Dec 29)
- Re: [patch] proc.5: tell how to parse /proc/*/stat correctly Alan Coopersmith (Dec 29)
- Re: [patch] proc.5: tell how to parse /proc/*/stat correctly Steffen Nurpmeso (Dec 29)
- Re: [patch] proc.5: tell how to parse /proc/*/stat correctly David A. Wheeler (Dec 29)
- Re: [patch] proc.5: tell how to parse /proc/*/stat correctly Jeffrey Walton (Dec 29)
- Re: [patch] proc.5: tell how to parse /proc/*/stat correctly Steffen Nurpmeso (Dec 29)
- Re: [patch] proc.5: tell how to parse /proc/*/stat correctly Steffen Nurpmeso (Dec 28)
- RE: [patch] proc.5: tell how to parse /proc/*/stat correctly David Laight (Dec 31)
- Re: [patch] proc.5: tell how to parse /proc/*/stat correctly Solar Designer (Dec 31)
- Message not available
- Re: [patch] proc.5: tell how to parse /proc/*/stat correctly Jakub Wilk (Dec 30)