lkml.org 
[lkml]   [1998]   [Jan]   [17]   [last100]   RSS Feed
Views: [more markup]  [less markup]  [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: Naughties (maybe security?) with /proc
From(Aaron M. Ucko)
Date17 Jan 1998 00:52:33 -0500
Chris Evans <chris@ferret.lmh.ox.ac.uk> writes:

> BTW: no one told me why Linux escaped the *BSD hole whereby you can mess
> with /proc/pid/mem, then exec a suid program, and mess with its memory.
> Anyone?

At least in 2.0.33, mem_read() and mem_write() call get_task(), which
contains the fragment
                /*
                 * allow accesses only under the same circumstances
                 * that we would allow ptrace to work
                 */
                if (tsk) {
                        if (!(tsk->flags & PF_PTRACED)
                            || tsk->state != TASK_STOPPED
                            || tsk->p_pptr != current)
                                tsk = NULL;
                }

-- 
Aaron M. Ucko <amu@mit.edu> (finger amu@monk.mit.edu) [Stark raving sane]

\
 
 \ /
  Last update: 2005-03-22 12:41    [from the cache]
©2003-2008