![]() | |||||||||||||
Messages in this thread |
On 4 Apr 2003, Alan Cox wrote: > Thats not a sufficient fix except for people blindly running the > example exploit Also, removing CAP_SYS_PTRACE from the capability bounded set does not close the hole (well, as shown by the exploit) either. It seems CAP_SYS_PTRACE only closes the case of PTRACE_ATTACH, all other ptrace()'s work, eg PTRACE_TRACEME -> strace echo foo and the exploit works too. Should CAP_SYS_PTRACE not do as the name suggests and completely disallow ptrace()? (not just PTRACE_ATTACH). regards, -- Paul Jakma paul@clubi.ie paul@jakma.org Key ID: 64A2FF6A warning: do not ever send email to spam@dishone.st Fortune: An egghead is one who stands firmly on both feet, in mid-air, on both sides of an issue. -- Homer Ferguson - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/ | ||||||||||||
| Last update: 2005-03-22 12:34 [W:0.474 / U:0.160 seconds] ©2003-2008 Jasper Spaans | |||||||||||||