Messages in this thread | | | Date | Fri, 27 Jan 2023 12:34:50 -0800 | From | Kees Cook <> | Subject | Re: [PATCH v3 1/2] exec: add PR_HIDE_SELF_EXE prctl |
| |
On Fri, Jan 27, 2023 at 01:31:13PM +0100, Christian Brauner wrote: > From: Christian Brauner (Microsoft) <brauner@kernel.org> > > > On Fri, 20 Jan 2023 11:25:11 +0100, Giuseppe Scrivano wrote: > > This patch adds a new prctl called PR_HIDE_SELF_EXE which allows > > processes to hide their own /proc/*/exe file. When this prctl is > > used, every access to /proc/*/exe for the calling process will > > fail with ENOENT. > > > > This is useful for preventing issues like CVE-2019-5736, where an > > attacker can gain host root access by overwriting the binary > > in OCI runtimes through file-descriptor mishandling in containers. > > > > [...] > > Only needed for privileged sandboxes. The userspace mitigations Aleksa > and I did for the CVE in all affected runtimes back then are nifty but > complicated. The patch is a decent compromise. > Picking up this prctl() for now, > > [1/2] exec: add PR_HIDE_SELF_EXE prctl > commit: 673301182d473ef61a98c292cf64650c73117172 > [2/2] selftests: add tests for prctl(SET_HIDE_SELF_EXE) > commit: bafa339eda3f79d567386e1fae59bb0537156c96
Thanks! I'm late to the party, but I came to the same conclusion as you did. :)
Reviewed-by: Kees Cook <keescook@chromium.org>
-- Kees Cook
| |