Messages in this thread |  | | | Date | Thu, 26 May 2011 20:54:32 +0200 | | From | Ingo Molnar <> | | Subject | Re: [PATCH 3/5] v2 seccomp_filters: Enable ftrace-based system call filtering |
| |
* Linus Torvalds <torvalds@linux-foundation.org> wrote:
> And if you filter system calls, it's entirely possible that you can > attack suid executables through such a vector. Your "limit system > calls for security" security suddenly turned into "avoid the system > call that made things secure"!
That should not be possible with Will's event filter based solution (his last submitted patch), due to this code in fs/exec.c (which is in your upstream tree as well):
/* * Flush performance counters when crossing a * security domain: */ if (!get_dumpable(current->mm)) perf_event_exit_task(current); This will drop all filters if a setuid-root (or whatever setuid) binary is executed from a filtered environment.
Does this cover the case you were thinking of?
Thanks,
Ingo
|  |