lkml.org 
[lkml]   [2011]   [May]   [26]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    SubjectRe: [PATCH 3/5] v2 seccomp_filters: Enable ftrace-based system call filtering
    From
    Date
    On Thu, 2011-05-26 at 09:46 -0700, Linus Torvalds wrote:

    > And if you filter system calls, it's entirely possible that you can
    > attack suid executables through such a vector. Your "limit system
    > calls for security" security suddenly turned into "avoid the system
    > call that made things secure"!
    >
    > See what I'm saying?

    So you are not complaining about this implementation, but the use of
    syscall filtering?

    There may be some user that says, "oh I don't want my other apps to be
    able to call setuid" thinking it will secure their application even
    more. But because that application did the brain dead thing to not check
    the return code of setuid, and it just happened to be running
    privileged, it then execs off another application that can root the box.

    Because, originally that setuid would have succeeded if the user did
    nothing special, but now with this filtering, and the user thinking that
    they could limit their app from doing harm, they just opened up a hole
    that caused their app to do the exact opposite and give the exec'd app
    full root privileges.

    Did I get this right?

    -- Steve




    \
     
     \ /
      Last update: 2011-05-26 19:09    [W:0.020 / U:29.500 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site