Tainting from user space
Posted May 31, 2006 19:33 UTC (Wed) by
caitlinbestler (guest, #32532)
In reply to:
Tainting from user space by kravi
Parent article:
Tainting from user space
Access to a specific set of physical pages, as is required
for RDMA and graphics cards, is not what I would call "raw
access". It is resource allocation. The fact that a user
can damage a resource that has been allocated to it does
not make the kernel itself suspect.
However, a kernel that grants a user process permission
to write to *any* memory (including the kernel) doesn't
have much of a leg to stand on in making distinctions
between "tainted" code and "non-tainted" code. As soon
as the permission to update the memory where the kernel's
code is stored is granted to a user process, that user
process effectively becomes part of the kernel.
(
Log in to post comments)
