Messages in this thread | | | From | Andrew Lutomirski <> | Date | Fri, 6 Apr 2012 14:15:19 -0700 | Subject | Re: [PATCH v17 01/15] Add PR_{GET,SET}_NO_NEW_PRIVS to prevent execve from granting privs |
| |
On Fri, Apr 6, 2012 at 2:04 PM, Markus Gutschke <markus@chromium.org> wrote: > On Fri, Apr 6, 2012 at 13:54, Andrew Lutomirski <luto@mit.edu> wrote: >> (FWIW, I think that CLONE_NEWPID interacts badly with unix socket >> credentials and should be fixed as a prerequisite for making it easier >> to access.) > > sendmsg() is a big hair ball. And yes, I have all sorts of things on > my wish list that touch sendmsg(). I don't think, I'll get them > fullfilled anytime soon, though: > > - sendmsg() does lots of different things: sending on unconnected > sockets, sending file descriptors, sending unix decriptors, and > plain-old sending data. These operations have very different security > properties and implications. It would be awesome if BPF filters could > filter these different types of operations selectively. > > - ancillary data is a cool concept in general. We should use it more. > If I could send a memory mapping from one process to another, that > would solve so many problems. But I know, I am dreaming; I don't > expect to see this feature any time soon. >
Agreed, but I'm talking about something totally different: if I can use CLONE_NEWPID, then I can send an unexpected pid with SCM_CREDS. The SCM_CREDS receive code should remap pids.
--Andy -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |