[lkml]   [2004]   [Oct]   [17]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    SubjectRe: [patch] exec-shield-nx-2.6.9-A1
    You have some bits in this patch that don't belong.
    They aren't even conditional on a config option or
    sysctl value.

    First, you change the permission on the /proc/*/maps file.
    Normally a remote attacker is unable to read this anyway,
    and a local setuid attack has time to try until success.
    Changing the permission might be a good idea, mostly
    because it exposes filenames, but it should be a separate

    Second, you restrict wchan. Oddly, you don't allow for
    the target task's euid to play a role, and you chose the
    CAP_SYS_NICE bit instead of some other bit. Huh? One might
    guess from CAP_SYS_NICE that the feature has now become
    hopelessly slow. Same as with the maps file, this should
    be a separate patch.

    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to
    More majordomo info at
    Please read the FAQ at

     \ /
      Last update: 2005-03-22 14:07    [W:0.019 / U:28.316 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site