![]() | |||||||||||||
Messages in this thread |
Linus Torvalds wrote: > In particular, it's fairly easy to create a shared library that replaces a > system library (LD_LIBRARY_PATH) and then just dumps out the binary image. > What prevents you from injecting a shared library and manipulating a suid executable? Does the environment get cleared when you exec a suid program? Or does the dynamic linker just notice euid != uid and ignore the LD environment variables? If so then would adding the sgid bit and making the binary owned by a powerless group effectively prevent this attack vector to read it? - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/ | ||||||||||||
| Last update: 2006-03-17 20:42 [from the cache] ©2003-2008 | |||||||||||||