Messages in this thread | | | Date | Mon, 3 Mar 2008 09:50:15 -0300 | From | "Luiz Fernando N. Capitulino" <> | Subject | Re: [PATCH 1/1] file capabilities: remove cap_task_kill() |
| |
Em Fri, 29 Feb 2008 15:26:34 -0600 serge@hallyn.com escreveu:
| Quoting Luiz Fernando N. Capitulino (lcapitulino@mandriva.com.br): | > Em Thu, 28 Feb 2008 11:38:17 -0600 | > serge@hallyn.com escreveu: | > | > | The original justification for cap_task_kill() was as follows: | > | | > | check_kill_permission() does appropriate uid equivalence checks. | > | However with file capabilities it becomes possible for an | > | unprivileged user to execute a file with file capabilities | > | resulting in a more privileged task with the same uid. | > | | > | However now that cap_task_kill() always returns 0 (permission | > | granted) when p->uid==current->uid, the whole hook is worthless, | > | and only likely to create more subtle problems in the corner cases | > | where it might still be called but return -EPERM. Those cases | > | are basically when uids are different but euid/suid is equivalent | > | as per the check in check_kill_permission(). | > | | > | This patch removes cap_task_kill(). | > | > 2.6.24 seems to have the same bug, what about a rediff for it and | > submit the patch to -stable team? | | Luiz, could you confirm that the below works?
Yes, it does.
Thanks.
-- Luiz Fernando N. Capitulino
| |