Messages in this thread | | | Date | Tue, 20 Mar 2012 02:47:46 +0400 | From | Cyrill Gorcunov <> | Subject | Re: [patch 1/2] c/r: prctl: Add ability to set new mm_struct::exe_file |
| |
On Mon, Mar 19, 2012 at 11:41:36PM +0100, richard -rw- weinberger wrote: > > > > Actually I liked multi-shot version more but Matt arguments convinced > > me that one-short fashion is more "secure" in terms of overall kernel > > state and potential transitions/changes of this /proc/pid/exe symlink. > > > > At least with one-shot version the admin may be sure that the symlink > > is never changed more than once, ever. > > > > And changing it once does not harm security? > I'm sure that rootkit writers will like this feature...
The one-shot limits the amount of transitions, but you still have to obtain CAP_SYS_RESOURCE before you'll be able to change this symlink (ie it's not 'anyone-can-change-it' feature).
Cyrill
| |