lkml.org 
[lkml]   [1998]   [Jun]   [15]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
SubjectRe: [patch] /proc fix and experimental security patch
Date
> -	int ino = inode->i_ino & 0xffff;
>
> read_lock(&tasklist_lock);
> if (fill && (p = find_task_by_pid(pid)) != NULL) {
> - if (p->dumpable || ino == PROC_PID_INO) {
> - inode->i_uid = p->euid;
> - inode->i_gid = p->gid;
> - }
> + inode->i_uid = p->euid;
> + inode->i_gid = p->gid;

This appears to be a security hole.

Setuid processes in unix are driven on the basis that even if they drop the
setuid they may contain information that is 'private'. You can neither
ptrace nor core dump them. Now you appear to have added the ability to
access their 'mem' file in /proc freely


-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu

\
 
 \ /
  Last update: 2005-03-22 13:43    [W:0.060 / U:0.512 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site