The Linux Backdoor Attempt of 2003

Freedom to Tinker ^ | 9 October 2013 | Ed Felten

[rarestia]

Many programming languages have since changed Boolean and equality checks to utilize linguistic code in addition to old-school code.

A good example is Microsoft’s Powershell or VBscript where one can use equality identifiers such as “-eq” or “-lt/-gt” (less-than/greater-than) in addition to the conventional syntax.

I’ve taken a liking to -eq or even -like for a more loose check.

This article, by the way, continues to bolster the open source movement as a much better, safer alternative to closed-source operating systems like Windows and OSX. Huzzah for community acceptance!

[zeugma]

The PRC, Russia, NSA, a private group of would be hackers etc. Lots of suspects here.

Isn't it sad that we have to lump the NSA in with the other nefarious types?

It has not been "our" government for a long time.

[sten]

an interesting secondary check would be to look for any code out there that would make the call with both of those options set. see if something was checked in somewhere... and maybe follow from there

[2 Kool 2 Be 4-Gotten]

I think this is a system call so the call would likely come from user land so it’s not like you could just scan the kernel code base - I wonder if it’s simply something that could be called from any arbitrary userland program which effectively means there’s no fixed code base to scan. Assuming this is in the code that handles the system calls from userland.

[2 Kool 2 Be 4-Gotten]

Well, OK, but this is from kernel code and last time I checked there as no Powershell or VBScript in the linux kernel nor do I expect that to happen any time soon :)

[lbryce]

Certainly in 2013 Obama would ‘back door’ any opportunity he can.

[cynwoody]

Whether this itself makes sense (i.e. to only take the conditional if both flags are set) or it this would tend to be something with some more devious intent - I don’t have enough knowledge to say.

C short-circuit evaluates conditionals. That means, if the first term of an ANDed pair of terms is false, the second term is never evaluated.

So, in this case, the term (options == (__WCLONE|__WALL) is acting as an "open sesame" incantation. You have to know about it in order to open the backdoor. Unless the options check evaluates to true, the (current->uid = 0) is simply skipped. If the options check does evaluate true, then the uid gets set to zero (root), and the number zero is evaluated as a boolean, resulting in a value of false. Thus, in neither case does retval = -EINAL; take place.

[2 Kool 2 Be 4-Gotten]

True enough. However, I didn’t mean to imply anything different.

My point wasn’t the contrary of what you are saying. My point was more along the lines of not knowing if the case of having both flags being true was a “real case” that comes up in daily life or instead was basically a “open sesame” case stuck in for malicious intent.

[rarestia]

Agreed. I was speaking to wider languages. I don’t expect kernel code to ever be modified.