Messages in this thread | | | Date | Thu, 24 Jul 2014 22:50:13 +0400 | From | Cyrill Gorcunov <> | Subject | Re: [RFC 2/2] prctl: PR_SET_MM -- Introduce PR_SET_MM_MAP operation |
| |
On Thu, Jul 24, 2014 at 11:44:50AM -0700, Kees Cook wrote: ... > > > > The file can have a suid bit, so after executing it we may lose ability > > to attach to it. To check that we can check that uid and gid is zero > > in a current userns (local root). > > > > What else do we need to check? > > Yeah, I think all the checks are sufficient, but I (and Julien) are > still trying to think about side-effects. > > It would be nice if these checks (like the rlimit checks) were merged > into some common helper. That way if something changes in the exec > path, it won't go missed in the c/r path.
For rlimit I've done a separate helper in new rfc series, please take a look.
| |