lkml.org 
[lkml]   [1996]   [May]   [7]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
SubjectRe: As 2.0 looms
Date
> > - /proc is still insecure :-(.  You can open /proc/<pid>/mem and
> > hold the file descriptor, then have the target process exec some
> > setuid/setgid/unreadable program and read its memory at will.
> > Not good for things like ssh - the secret host key is there...
>
> Oh, ****, has this _still_ not been fixed ?

Quick fix in .96, but breaks at least some versions of strace. Changed
in .98 - strace works again, but I think there may be a race condition
if read() passes the checks, sleeps on memcpy_tofs() due to a swap-in,
and the target process execs a setuid program in this time window.

> If I revamp my /proc-paranoia patch for 1.3.x, will it get accepted,
> or should I not bother ?

Ask Linus :-). He might not like encoding the flag in the sticky bit of
/proc - maybe add a struct proc_sb_info containing mount flags (there
might be more in the future) like other filesystems do.

Marek


\
 
 \ /
  Last update: 2005-03-22 13:37    [W:0.157 / U:2.736 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site