[lkml]   [2012]   [Mar]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    SubjectRe: [patch 1/2] c/r: prctl: Add ability to set new mm_struct::exe_file
    On Mon, Mar 19, 2012 at 11:41:36PM +0100, richard -rw- weinberger wrote:
    > >
    > > Actually I liked multi-shot version more but Matt arguments convinced
    > > me that one-short fashion is more "secure" in terms of overall kernel
    > > state and potential transitions/changes of this /proc/pid/exe symlink.
    > >
    > > At least with one-shot version the admin may be sure that the symlink
    > > is never changed more than once, ever.
    > >
    > And changing it once does not harm security?
    > I'm sure that rootkit writers will like this feature...

    The one-shot limits the amount of transitions, but you still
    have to obtain CAP_SYS_RESOURCE before you'll be able to change
    this symlink (ie it's not 'anyone-can-change-it' feature).


     \ /
      Last update: 2012-03-19 23:51    [W:0.019 / U:0.548 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site