Subject: Re: COMPAT_NETBSD32's execve, copy/paste of code
To: Quentin Garnier <cube@cubidou.net>
From: Wolfgang Solfrank <ws@tools.de>
List: tech-kern
Date: 07/11/2005 16:35:47
Hi,

> To properly fix netbsd32_wait4(), the only thing that would be needed is
> a slighly smarter copyin()/copyout() that would check if the supposedly
> user address is actually a kernel address or not, and in the former case
> only do a memcpy().  I don't know if it easy to do that, even if it ends
> as a set of MD implementations.  I do know that it wouldn't be only
> useful for compat_netbsd32, though.

I'm not sure that I do understand what you are trying to do here.

However, it sounds that you are trying to allow copyin/copyout to silently
access kernel memory as source/destination respevtively.  Apart from Christos'
comment regarding the possibility of determining a kernel from a user address,
this is not a good idea.  copyin/copyout is not only for transferring data
between the user and kernel domain, but is also used to check for access
protection.  IIUC what you are proposing, this would open up serious security
holes...

Ciao,
Wolfgang
-- 
ws@TooLs.DE                            Wolfgang Solfrank, TooLs GmbH