Re: Is ndo_do_ioctl still acceptable?

From	"Jason A. Donenfeld" <Jason@zx2c4.com>
Newsgroups	linux.kernel
Subject	Re: Is ndo_do_ioctl still acceptable?
Date	2015-11-12 23:20 +0100
Message-ID	<qu8nL-6oo-11@gated-at.bofh.it> (permalink)
References	<qtS9k-4gx-1@gated-at.bofh.it> <qu34L-2QO-31@gated-at.bofh.it> <qu3o6-2Yr-19@gated-at.bofh.it> <qu6P0-5ho-31@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

On Thu, Nov 12, 2015 at 9:30 PM, Austin S Hemmelgarn
<ahferroin7@gmail.com> wrote:
>>
> On the other hand, based on what you are saying about your device, it sounds
> like you are working on some kind of cryptographically secured (either
> authenticated or encrypted or both) tunnel, in which case the fact that
> security is easier to handle with netlink than ioctls becomes important.  If
> you can't ensure security of the endpoint configuration, you can't ensure
> security of the tunnel itself.

Could you substantiate these claims that "security is easier to handle
with netlink". I've never heard this and I don't know why it'd be the
case. Are you referring to the fact that the copy_to/from_user dance
of ioctl opens up more potential vulnerabilities than netlink's
abstracted validation? Or something else? Just confused here...
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Thread

Is ndo_do_ioctl still acceptable? "Jason A. Donenfeld" <Jason@zx2c4.com> - 2015-11-12 06:00 +0100
  Re: Is ndo_do_ioctl still acceptable? Stephen Hemminger <stephen@networkplumber.org> - 2015-11-12 17:40 +0100
    Re: Is ndo_do_ioctl still acceptable? "Jason A. Donenfeld" <Jason@zx2c4.com> - 2015-11-12 18:00 +0100
      Re: Is ndo_do_ioctl still acceptable? Austin S Hemmelgarn <ahferroin7@gmail.com> - 2015-11-12 21:40 +0100
        Re: Is ndo_do_ioctl still acceptable? "Jason A. Donenfeld" <Jason@zx2c4.com> - 2015-11-12 23:20 +0100
          Re: Is ndo_do_ioctl still acceptable? Stephen Hemminger <stephen@networkplumber.org> - 2015-11-12 23:30 +0100

csiph-web