Messages in this thread | | | From | (Eric W. Biederman) | Date | Tue, 29 Dec 2009 12:40:55 -0800 | Subject | Re: RFC: disablenetwork facility. (v4) |
| |
Benny Amorsen <benny+usenet@amorsen.dk> writes:
> Bryan Donlan <bdonlan@gmail.com> writes: > >> I, for one, think it would be best to handle it exactly like the >> nosuid mount option - that is, pretend the file doesn't have any >> setuid bits set. There's no reason to deny execution; if the process >> would otherwise be able to execute it, it can also copy the file to >> make a non-suid version and execute that instead. > > Execute != read. The executable file may contain secrets which must not > be available to the user running the setuid program. If you fail the > setuid, the user will be able to ptrace() and then the secret is > revealed. > > It's amazing how many security holes appear from what seems like a very > simple request.
Do we have a security hole in nosuid mount option? Can someone write a patch to fix it?
Eric
| |