Re: The disappearing sys_call_table export.

[Ahmed Masud]

Hi Arjan,

On 10 May 2003, Arjan van de Ven wrote:

> On Sat, 2003-05-10 at 16:38, Ahmed Masud wrote:
>
> > Case in point, I wrote a security module for Linux that overrides _all_
> > 237 systemcalls to audit and control the use of the system calls on a per
> > uid basis.  (i.e. if the user was actually allowed to make the system call
> > or not) and return -EPERM or jump to system call proper.
>
> I'm pretty sure that auditing by your module can easily be avoided.
>
> examle: pseudocode for the unlink syscall
>
> long your_wrapped_syscall(char *userfilename)
> {
>     char kernelpointer[something];
>     copy_from_user(kernelpointer, usefilename, ...);
>     audit_log(kernelpointer);
>     return original_syscall(userfilename);
> }
>
> now.... the original syscall does ANOTHER copy_from_user().
> Eg I can easily fool your logging by having a second thread change the
> filename between the time your code copies it and the time the original
> syscall copies it again. The chances of getting the timing right are 50%
> at least (been there done that ;)

You are right, if operations occur in the sequence above.

What are your thoughts on the following two
A)
	long wrapper_call(args) {
		yield(random(threshold)); /* yeild is a sleep */
		rv = orig_syscall(args...);
		copy_from_user(audit_data,args...);
		audit_log(audit_data);
		return rv;
	}

That becomes a bit more difficult to time, because the attacker doesn't
know when the system call will actually perform its own copy_from_user vs.
return vs. the audit's copy_from_user, If the correct upper threshold for
each system call is picked timing attacks can be made alot harder.

B)
	long wrapper_call(args) {
		yield(random(threshold));
		copy_from_user(audit_data1,args...);
		rv = orig_syscall(args...);
		yield(random(threshold));
		copy_from_user(audit_data2,args...);
		audit_log(audit_data1);
		audit_log(audit_data2);
		return rv;
	}

Suspicious data analysis is then performed by a user-land tool to
further ensure integrity.

I would just like to say that above does not pretend to be speed happy,
still for practical purposes you can assume that the yield is a lot
shorter (a couple of orders of magnitude) than the duration of the system
call.

Cheers,

Ahmed.