Messages in this thread | | | Subject | Re: [patch] exec-shield-nx-2.6.9-A1 | From | Albert Cahalan <> | Date | 17 Oct 2004 16:11:27 -0400 |
| |
You have some bits in this patch that don't belong. They aren't even conditional on a config option or sysctl value.
First, you change the permission on the /proc/*/maps file. Normally a remote attacker is unable to read this anyway, and a local setuid attack has time to try until success. Changing the permission might be a good idea, mostly because it exposes filenames, but it should be a separate patch.
Second, you restrict wchan. Oddly, you don't allow for the target task's euid to play a role, and you chose the CAP_SYS_NICE bit instead of some other bit. Huh? One might guess from CAP_SYS_NICE that the feature has now become hopelessly slow. Same as with the maps file, this should be a separate patch.
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |