SECURITY WARNING: do not use this module! Scroll down for more information in the discussion. This module disables a major part of kernel memory protection and trusts user provided file names to be valid. This makes it possible for an UNPRIVILEGED USER to do bad things.
These problems are, of course, fixable someone may fix it.
Bonus points for whoever fixes the problems and submits a pull request. All the info you need is in this discussion thread.
(edit: I can already see some pull requests on this)
I never had security in mind when developing this. I just did it for fun and to prove it was possible after I had the idea. It was never intended to go that popular.
I will incorporate all fixes and address all issues raised in the next few days.
You should never ever admit that you didn't think of security when writing code, especially in the kernel space :)
I think that instead of the strlen pull request you accepted, you should use getname/strncpy_from_user like the open() syscall does instead of strlen+memcpy.
Also, while you're here, could you explain what is the purpose of disabling memory write protection? Is it to allow writing to the syscall table? You seem to enable writing in the page table for the syscall table before writing, but never disable it. Could it be that you forgot to flush the translation lookaside buffer (TLB) after updating the pagetable and the change you did does not take effect soon enough? I don't know how you flush TLB's in Linux but the Intel manuals tell you to do so after updating the page table.
It's fun to see that there were so many people interested in this, although it's not much more than a joke. I guess part of the interest stems from the fact that it's a small kernel module with so little code that it's easy to grok.
> You should never ever admit that you didn't think of security when writing code
For a joke weekend project that you never intended anyone to see / use seriously? Sorry, no. I would never waste time making something secure that I did for funzies that I'll likely never touch again. If I happen to come across or realize a security issue as I'm writing it I might make a comment there in the source or in the README. Otherwise, that's time spent I could have been making my real projects better and more secure.
These problems are, of course, fixable someone may fix it.
Bonus points for whoever fixes the problems and submits a pull request. All the info you need is in this discussion thread.
(edit: I can already see some pull requests on this)