lkml.org 
[lkml]   [1998]   [Jun]   [15]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [patch] /proc fix and experimental security patch
Alan Cox wrote:
>
> > - int ino = inode->i_ino & 0xffff;
> >
> > read_lock(&tasklist_lock);
> > if (fill && (p = find_task_by_pid(pid)) != NULL) {
> > - if (p->dumpable || ino == PROC_PID_INO) {
> > - inode->i_uid = p->euid;
> > - inode->i_gid = p->gid;
> > - }
> > + inode->i_uid = p->euid;
> > + inode->i_gid = p->gid;
>
> This appears to be a security hole.
>
> Setuid processes in unix are driven on the basis that even if they drop the
> setuid they may contain information that is 'private'. You can neither
> ptrace nor core dump them. Now you appear to have added the ability to
> access their 'mem' file in /proc freely
Aha. That's why I was asking how it should be...

So, what to do here? Maybe it's correct to have /proc/pid dir for that
process be old uid/gid?

Vadim

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu

\
 
 \ /
  Last update: 2005-03-22 13:43    [from the cache]
©2003-2011 Jasper Spaans