Messages in this thread | | | From | (Alan Cox) | Subject | Re: [patch] /proc fix and experimental security patch | Date | Mon, 15 Jun 1998 11:40:46 +0100 (BST) |
| |
> - int ino = inode->i_ino & 0xffff; > > read_lock(&tasklist_lock); > if (fill && (p = find_task_by_pid(pid)) != NULL) { > - if (p->dumpable || ino == PROC_PID_INO) { > - inode->i_uid = p->euid; > - inode->i_gid = p->gid; > - } > + inode->i_uid = p->euid; > + inode->i_gid = p->gid;
This appears to be a security hole.
Setuid processes in unix are driven on the basis that even if they drop the setuid they may contain information that is 'private'. You can neither ptrace nor core dump them. Now you appear to have added the ability to access their 'mem' file in /proc freely
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.rutgers.edu
| |