Messages in this thread | | | Date | Tue, 20 Mar 2012 02:50:20 +0400 | From | Cyrill Gorcunov <> | Subject | Re: [patch 1/2] c/r: prctl: Add ability to set new mm_struct::exe_file |
| |
On Mon, Mar 19, 2012 at 03:46:49PM -0700, Andrew Morton wrote: > > Please send a patch with the updated changelog and improved comment?
Sure I'll resend.
> > > > > > > Actually I liked multi-shot version more but Matt arguments convinced > > > me that one-short fashion is more "secure" in terms of overall kernel > > > state and potential transitions/changes of this /proc/pid/exe symlink. > > > > > > At least with one-shot version the admin may be sure that the symlink > > > is never changed more than once, ever. > > > > > > > And changing it once does not harm security? > > I'm sure that rootkit writers will like this feature... > > Well, let's discuss this more completely. In what ways could an > attacker use this? How serious is the problem? What actions can be > taken to lessen it? etcetera.
It can use it iif CAP_SYS_RESOURCE is granted. Otherwise you'll get -eaccess.
Cyrill
| |