Messages in this thread | | | Date | Tue, 20 Mar 2012 03:17:09 +0400 | From | Cyrill Gorcunov <> | Subject | Re: [patch 1/2] c/r: prctl: Add ability to set new mm_struct::exe_file |
| |
On Tue, Mar 20, 2012 at 12:02:44AM +0100, richard -rw- weinberger wrote: > On Mon, Mar 19, 2012 at 11:46 PM, Andrew Morton > <akpm@linux-foundation.org> wrote: > > Well, let's discuss this more completely. In what ways could an > > attacker use this? How serious is the problem? What actions can be > > taken to lessen it? etcetera. > > After considering the problem a bit more I think it's not a big problem. > We must not trust /proc/pid/exe in anyway.
Well, Richard, we probably do not trust it anyway but sysadmins might do (and this was another reason for one-shot behaviour -- to not bring heart attacks to sysadmins, and everyone would know this link might be changed only one time ;)
> An attacker can always execute another binary without calling execve().
That's what c/r basically does :)
> > So, why makes that one-short fashion the feature more secure? > Let the user change the exe symlink as often as he wants. > From a security point of view the exe symlink is anyway useless.
Maybe better to call it 'predictable' then rather than 'secure'?
Cyrill -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |