[lkml]   [2004]   [Sep]   [4]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    SubjectRe: [Umbrella-devel] Re: Getting full path from dentry in LSM hooks
    On Fri, 2004-09-03 at 22:39, wrote:
    > All this does is stop fork(). I'm not sure, but most shellcodes I've seen
    > don't bother forking, they just execve() a shell....

    I think you totally misunderstood the thing...

    Umbrella is a scheme that allow the user to restrict the capabilities of
    a process within his own processes. Preventing the process to fork is
    ONE thing that can be restricted but they might be plenty of others.

    The idea is that each process originating from this process will inherit
    from this restriction (and possibly have some more) and can NEVER been
    granted to restore this capability again.

    Now, this has a direct application to restrict the harm that can cause a
    buffer-overflow, but nobody said that it would stop them... As Kristian
    say all the time: « We can't prevent the rain, but we don't get wet. »

    > Remember - just papering over the fact that most shellcodes just execve() a
    > shell doesn't fix the fundemental problem, which is that the attacker is able
    > to run code of his choosing as root.


    Wonderful ! You just volunteered to find a simple and yet efficient
    solution to this problem ! :)

    Emmanuel Fleury

    Computer Science Department, | Office: B1-201
    Aalborg University, | Phone: +45 96 35 72 23
    Fredriks Bajersvej 7E, | Fax: +45 98 15 98 89
    9220 Aalborg East, Denmark | Email:

    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to
    More majordomo info at
    Please read the FAQ at

     \ /
      Last update: 2005-03-22 14:05    [W:0.020 / U:1.872 seconds]
    ©2003-2017 Jasper Spaans. hosted at Digital OceanAdvertise on this site