[lkml]   [2010]   [Jun]   [17]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    SubjectRe: [PATCH] ptrace: allow restriction of ptrace scope
    Kees Cook <> writes:

    > As Linux grows in popularity, it will become a larger target for
    > malware. One particularly troubling weakness of the Linux process
    > interfaces is that a single user is able to examine the memory and
    > running state of any of their processes. For example, if one application
    > (e.g. Pidgin) was compromised, it would be possible for an attacker to
    > attach to other running processes (e.g. Firefox, SSH sessions, GPG agent,
    > etc) to extract additional credentials and continue to expand the scope
    > of their attack without resorting to user-assisted phishing.
    > This is not a theoretical problem. SSH session hijacking
    > ( and arbitrary code injection
    > ( attacks already
    > exist and remain possible if PTRACE is allowed to operate as before.
    > PTRACE is not commonly used by non-developers and non-admins, so system
    > builders should be allowed the option to disable this debugging system.
    > For a solution, some applications use prctl(PR_SET_DUMPABLE, ...) to
    > specifically disallow such PTRACE attachment (e.g. ssh-agent), but many
    > do not. A more general solution is to only allow PTRACE directly from a
    > parent to a child process (i.e. direct "gdb EXE" and "strace EXE" still
    > work), or with CAP_SYS_PTRACE (i.e. "gdb --pid=PID", and "strace -p PID"
    > still work as root).
    > This patch is based on the patch in grsecurity. It includes a sysctl
    > to enable the behavior via /proc/sys/kernel/ptrace_scope. This could
    > be expanded in the future to further restrict PTRACE to, for example,
    > only CAP_SYS_PTRACE (scope 2) or only init (scope 3).

    This is ineffective. As an attacker after I gain access to a users
    system on ubuntu I can wait around until a package gets an update,
    and then run sudo and gain the power to do whatever I want.

    Either that or I can inject something nasty into the suid pulse-audio.

    I tell you what. If you really want something effective, help Serge
    and I finish getting the cross namespace issues fixed for the user
    namespace. When complete, it will possible for an unprivileged process
    to create a new one, and since kernel capabilities along with everything
    else will be local to it, running pidgin, or firefox, or another network
    facing potentially buggy application in such a namespace will ensure that
    even if the process is compromised it won't have privileges to ptrace another
    process or do much else on the system.


     \ /
      Last update: 2010-06-17 14:33    [W:0.024 / U:0.072 seconds]
    ©2003-2017 Jasper Spaans. hosted at Digital OceanAdvertise on this site