Messages in this thread | | | Date | Wed, 1 Feb 2012 10:14:31 -0800 | Subject | Re: [PATCH v3 1/4] Add PR_{GET,SET}_NO_NEW_PRIVS to prevent execve from granting privs | From | Kees Cook <> |
| |
On Mon, Jan 30, 2012 at 8:17 AM, Andy Lutomirski <luto@amacapital.net> wrote: > With this set, a lot of dangerous operations (chroot, unshare, etc) > become a lot less dangerous because there is no possibility of > subverting privileged binaries. > > This patch completely breaks apparmor. Someone who understands (and > uses) apparmor should fix it or at least give me a hint. > > Signed-off-by: Andy Lutomirski <luto@amacapital.net>
Looking forward to this -- it'll give us a lot more flexibility.
Reviewed-by: Kees Cook <keescook@chromium.org>
-- Kees Cook ChromeOS Security -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |