Messages in this thread | | | Date | Mon, 23 Jan 2012 17:56:44 +0100 | From | Oleg Nesterov <> | Subject | Re: Compat 32-bit syscall entry from 64-bit task!? [was: Re: [RFC,PATCH 1/2] seccomp_filters: system call filtering using BPF] |
| |
On 01/18, Chris Evans wrote: > > Thanks, Oleg. Seems like this would be a nice change to have. As we > can see, people do use ptrace() as a security technology.
OK, I'll send it.
> With this in place, you can also (where possible) set up the tracee > with PR_SET_PDEATHSIG==SIGKILL. And then, you have defences again > either of the tracer or tracee dying from a stray SIGKILL.
This can only help if the tracer is the natural parent, is it enough?
Indan suggested PTRACE_O_SIGKILL_ON_DEATH, perhaps it makes sense.
Oleg.
| |