Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.c > #126310 > unrolled thread

System V Shared Memory Security

Started byhwding <m@amastigote.com>
First post2018-02-05 17:26 -0800
Last post2018-02-14 00:49 +0800
Articles 12 — 8 participants

Back to article view | Back to comp.lang.c

Contents

  System V Shared Memory Security hwding <m@amastigote.com> - 2018-02-05 17:26 -0800
    Re: System V Shared Memory Security Ian Collins <ian-news@hotmail.com> - 2018-02-06 14:30 +1300
      Re: System V Shared Memory Security hwding <m@amastigote.com> - 2018-02-05 17:33 -0800
        Re: System V Shared Memory Security Keith Thompson <kst-u@mib.org> - 2018-02-05 18:14 -0800
    Re: System V Shared Memory Security Lew Pitcher <lew.pitcher@digitalfreehold.ca> - 2018-02-05 20:32 -0500
    Re: System V Shared Memory Security Les Cargill <lcargill99@comcast.com> - 2018-02-09 21:28 -0600
      Re: System V Shared Memory Security scott@slp53.sl.home (Scott Lurndal) - 2018-02-11 17:23 +0000
        Re: System V Shared Memory Security Les Cargill <lcargill99@comcast.com> - 2018-02-11 12:09 -0600
          Re: System V Shared Memory Security scott@slp53.sl.home (Scott Lurndal) - 2018-02-12 19:16 +0000
            Re: System V Shared Memory Security "Chris M. Thomasson" <invalid_chris_thomasson@invalid.invalid> - 2018-02-12 12:10 -0800
            Re: System V Shared Memory Security Les Cargill <lcargill99@comcast.com> - 2018-02-12 21:00 -0600
    Re: System V Shared Memory Security "Mr. Man-wai Chang" <toylet.toylet@gmail.com> - 2018-02-14 00:49 +0800

#126310 — System V Shared Memory Security

Fromhwding <m@amastigote.com>
Date2018-02-05 17:26 -0800
SubjectSystem V Shared Memory Security
Message-ID<c0a908ed-66cc-40c1-8ed5-2d34f42a280f@googlegroups.com>
Is it possible to attach to an existing SHM owned
by other process group and alter its content?

For example:
  # ipcs
  ------ Shared Memory Segments --------
  key        shmid      owner      perms      bytes      nattch     status
  0x01050404 196608     abcd       777        4096       2

  Then we attched to this segment using id 196608:
  shmat(196608, NULL, 0);
  Read then alter its data to attack these processes.

Is there a necessity to protect the sensitive content
when two processes are using a shared memory? By what
means?

[toc] | [next] | [standalone]

#126311

FromIan Collins <ian-news@hotmail.com>
Date2018-02-06 14:30 +1300
Message-ID<fdseosFc9eU2@mid.individual.net>
In reply to#126310
On 02/06/2018 02:26 PM, hwding wrote:
> Is it possible to attach to an existing SHM owned
> by other process group and alter its content?

comp.unix.programmer is a more appropriate place to ask.

-- 
Ian.

[toc] | [prev] | [next] | [standalone]

#126313

Fromhwding <m@amastigote.com>
Date2018-02-05 17:33 -0800
Message-ID<b23fc64d-fb66-4df0-8a4d-ce23650a76c0@googlegroups.com>
In reply to#126311
On Tuesday, February 6, 2018 at 9:30:17 AM UTC+8, Ian Collins wrote:
> On 02/06/2018 02:26 PM, hwding wrote:
> > Is it possible to attach to an existing SHM owned
> > by other process group and alter its content?
> 
> comp.unix.programmer is a more appropriate place to ask.
> 
> -- 
> Ian.

Thanks, finally found somewhere to ask, I'll delete this post later.

[toc] | [prev] | [next] | [standalone]

#126315

FromKeith Thompson <kst-u@mib.org>
Date2018-02-05 18:14 -0800
Message-ID<lnpo5i27b2.fsf@kst-u.example.com>
In reply to#126313
hwding <m@amastigote.com> writes:
[...]
> Thanks, finally found somewhere to ask, I'll delete this post later.

Don't bother.  For various historical reasons, cancelling Usenet posts
rarely works.

-- 
Keith Thompson (The_Other_Keith) kst-u@mib.org  <http://www.ghoti.net/~kst>
Working, but not speaking, for JetHead Development, Inc.
"We must do something.  This is something.  Therefore, we must do this."
    -- Antony Jay and Jonathan Lynn, "Yes Minister"

[toc] | [prev] | [next] | [standalone]

#126312

FromLew Pitcher <lew.pitcher@digitalfreehold.ca>
Date2018-02-05 20:32 -0500
Message-ID<p5b0js$i1f$1@dont-email.me>
In reply to#126310
hwding wrote:

> Is it possible to attach to an existing SHM owned
> by other process group and alter its content?
> 
> For example:
>   # ipcs
>   ------ Shared Memory Segments --------
>   key        shmid      owner      perms      bytes      nattch     status
>   0x01050404 196608     abcd       777        4096       2
> 
>   Then we attched to this segment using id 196608:
>   shmat(196608, NULL, 0);
>   Read then alter its data to attack these processes.
> 
> Is there a necessity to protect the sensitive content
> when two processes are using a shared memory? By what
> means?

The answers to all these questions, and more, can be yours for a simple 
visit to one of the comp.unix newsgroups. May I suggest
 comp.unix.programmer or comp.unix.questions ?

In any case, these questions are /really/ off-topic here

-- 
Lew Pitcher
"In Skills, We Trust"
PGP public key available upon request

[toc] | [prev] | [next] | [standalone]

#126507

FromLes Cargill <lcargill99@comcast.com>
Date2018-02-09 21:28 -0600
Message-ID<p5lojv$i4r$1@dont-email.me>
In reply to#126310
hwding wrote:
> Is it possible to attach to an existing SHM owned
> by other process group and alter its content?
> 
> For example:
>    # ipcs
>    ------ Shared Memory Segments --------
>    key        shmid      owner      perms      bytes      nattch     status
>    0x01050404 196608     abcd       777        4096       2
> 
>    Then we attched to this segment using id 196608:
>    shmat(196608, NULL, 0);
>    Read then alter its data to attack these processes.
> 
> Is there a necessity to protect the sensitive content
> when two processes are using a shared memory? 

Yes.

> By what
> means?
> 

Sempahores. Specifically, mutexes:

http://www.breti.org/tech/files/a6d7308bd5ee3c1af9176951bf957099-62.html

-- 
Les Cargill

[toc] | [prev] | [next] | [standalone]

#126581

Fromscott@slp53.sl.home (Scott Lurndal)
Date2018-02-11 17:23 +0000
Message-ID<e__fC.9688$yv1.116@fx07.iad>
In reply to#126507
Les Cargill <lcargill99@comcast.com> writes:
>hwding wrote:
>> Is it possible to attach to an existing SHM owned
>> by other process group and alter its content?
>> 
>> For example:
>>    # ipcs
>>    ------ Shared Memory Segments --------
>>    key        shmid      owner      perms      bytes      nattch     status
>>    0x01050404 196608     abcd       777        4096       2
>> 
>>    Then we attched to this segment using id 196608:
>>    shmat(196608, NULL, 0);
>>    Read then alter its data to attack these processes.
>> 
>> Is there a necessity to protect the sensitive content
>> when two processes are using a shared memory? 
>
>Yes.
>
>> By what
>> means?
>> 
>
>Sempahores. Specifically, mutexes:
>

man 3 pthread_mutex_lock
man 3 pthread_mutexattr_setpshared

[toc] | [prev] | [next] | [standalone]

#126583

FromLes Cargill <lcargill99@comcast.com>
Date2018-02-11 12:09 -0600
Message-ID<p5q0j8$unb$1@dont-email.me>
In reply to#126581
Scott Lurndal wrote:
> Les Cargill <lcargill99@comcast.com> writes:
>> hwding wrote:
>>> Is it possible to attach to an existing SHM owned
>>> by other process group and alter its content?
>>>
>>> For example:
>>>     # ipcs
>>>     ------ Shared Memory Segments --------
>>>     key        shmid      owner      perms      bytes      nattch     status
>>>     0x01050404 196608     abcd       777        4096       2
>>>
>>>     Then we attched to this segment using id 196608:
>>>     shmat(196608, NULL, 0);
>>>     Read then alter its data to attack these processes.
>>>
>>> Is there a necessity to protect the sensitive content
>>> when two processes are using a shared memory?
>>
>> Yes.
>>
>>> By what
>>> means?
>>>
>>
>> Sempahores. Specifically, mutexes:
>>
> 
> man 3 pthread_mutex_lock
> man 3 pthread_mutexattr_setpshared
> 

I don't think you can identify posix objects across full processes.

-- 
Les Cargill

[toc] | [prev] | [next] | [standalone]

#126611

Fromscott@slp53.sl.home (Scott Lurndal)
Date2018-02-12 19:16 +0000
Message-ID<HKlgC.10148$eZ5.9513@fx19.iad>
In reply to#126583
Les Cargill <lcargill99@comcast.com> writes:
>Scott Lurndal wrote:
>> Les Cargill <lcargill99@comcast.com> writes:
>>> hwding wrote:
>>>> Is it possible to attach to an existing SHM owned
>>>> by other process group and alter its content?
>>>>
>>>> For example:
>>>>     # ipcs
>>>>     ------ Shared Memory Segments --------
>>>>     key        shmid      owner      perms      bytes      nattch     status
>>>>     0x01050404 196608     abcd       777        4096       2
>>>>
>>>>     Then we attched to this segment using id 196608:
>>>>     shmat(196608, NULL, 0);
>>>>     Read then alter its data to attack these processes.
>>>>
>>>> Is there a necessity to protect the sensitive content
>>>> when two processes are using a shared memory?
>>>
>>> Yes.
>>>
>>>> By what
>>>> means?
>>>>
>>>
>>> Sempahores. Specifically, mutexes:
>>>
>> 
>> man 3 pthread_mutex_lock
>> man 3 pthread_mutexattr_setpshared
>> 
>
>I don't think you can identify posix objects across full processes.

That's the entire point of "pthread_mutexattr_setpshared".

[toc] | [prev] | [next] | [standalone]

#126616

From"Chris M. Thomasson" <invalid_chris_thomasson@invalid.invalid>
Date2018-02-12 12:10 -0800
Message-ID<p5sscl$kh9$1@dont-email.me>
In reply to#126611
On 2/12/2018 11:16 AM, Scott Lurndal wrote:
> Les Cargill <lcargill99@comcast.com> writes:
>> Scott Lurndal wrote:
>>> Les Cargill <lcargill99@comcast.com> writes:
>>>> hwding wrote:
>>>>> Is it possible to attach to an existing SHM owned
>>>>> by other process group and alter its content?
>>>>>
>>>>> For example:
>>>>>      # ipcs
>>>>>      ------ Shared Memory Segments --------
>>>>>      key        shmid      owner      perms      bytes      nattch     status
>>>>>      0x01050404 196608     abcd       777        4096       2
>>>>>
>>>>>      Then we attched to this segment using id 196608:
>>>>>      shmat(196608, NULL, 0);
>>>>>      Read then alter its data to attack these processes.
>>>>>
>>>>> Is there a necessity to protect the sensitive content
>>>>> when two processes are using a shared memory?
>>>>
>>>> Yes.
>>>>
>>>>> By what
>>>>> means?
>>>>>
>>>>
>>>> Sempahores. Specifically, mutexes:
>>>>
>>>
>>> man 3 pthread_mutex_lock
>>> man 3 pthread_mutexattr_setpshared
>>>
>>
>> I don't think you can identify posix objects across full processes.
> 
> That's the entire point of "pthread_mutexattr_setpshared".
> 

Fwiw, POSIX has the robust mutex:

http://pubs.opengroup.org/onlinepubs/9699919799/functions/pthread_mutexattr_getrobust.html

EOWNERDEAD is pretty interesting to work with. You need to check the 
data-structure and make sure that it is in a "stable and consistent" 
state wrt your application.

ENOTRECOVERABLE? Argh!

[toc] | [prev] | [next] | [standalone]

#126635

FromLes Cargill <lcargill99@comcast.com>
Date2018-02-12 21:00 -0600
Message-ID<p5tk34$65u$1@dont-email.me>
In reply to#126611
Scott Lurndal wrote:
> Les Cargill <lcargill99@comcast.com> writes:
>> Scott Lurndal wrote:
>>> Les Cargill <lcargill99@comcast.com> writes:
>>>> hwding wrote:
>>>>> Is it possible to attach to an existing SHM owned
>>>>> by other process group and alter its content?
>>>>>
>>>>> For example:
>>>>>      # ipcs
>>>>>      ------ Shared Memory Segments --------
>>>>>      key        shmid      owner      perms      bytes      nattch     status
>>>>>      0x01050404 196608     abcd       777        4096       2
>>>>>
>>>>>      Then we attched to this segment using id 196608:
>>>>>      shmat(196608, NULL, 0);
>>>>>      Read then alter its data to attack these processes.
>>>>>
>>>>> Is there a necessity to protect the sensitive content
>>>>> when two processes are using a shared memory?
>>>>
>>>> Yes.
>>>>
>>>>> By what
>>>>> means?
>>>>>
>>>>
>>>> Sempahores. Specifically, mutexes:
>>>>
>>>
>>> man 3 pthread_mutex_lock
>>> man 3 pthread_mutexattr_setpshared
>>>
>>
>> I don't think you can identify posix objects across full processes.
> 
> That's the entire point of "pthread_mutexattr_setpshared".
> 


Ooooohhh! Nice. I did not know that. Thanks!

-- 
Les Cargill

[toc] | [prev] | [next] | [standalone]

#126672

From"Mr. Man-wai Chang" <toylet.toylet@gmail.com>
Date2018-02-14 00:49 +0800
Message-ID<p5v4v4$978$1@toylet.eternal-september.org>
In reply to#126310
On 6/2/2018 09:26, hwding wrote:
> Is it possible to attach to an existing SHM owned
> by other process group and alter its content?
>...
> Is there a necessity to protect the sensitive content
> when two processes are using a shared memory? By what
> means?

Cause a disk thrashing, alter the memory stored in the file system? :)

-- 
   @~@   Remain silent! Drink, Blink, Stretch! Live long and prosper!!
  / v \  Simplicity is Beauty!
/( _ )\ May the Force and farces be with you!
   ^ ^   (x86_64 Ubuntu 9.10)  Linux 2.6.39.3
不借貸! 不詐騙! 不援交! 不打交! 不打劫! 不自殺! 請考慮綜援 (CSSA):
http://www.swd.gov.hk/tc/index/site_pubsvc/page_socsecu/sub_addressesa

[toc] | [prev] | [standalone]

Back to top | Article view | comp.lang.c

csiph-web