[lkml]   [1997]   [Nov]   [26]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectLinux proc exploit

Linux has a vulnerability in the proc filing system: it can be used by root to escape from
chroot() areas.

At least linux 2.0.32 as distributed by redhat is vulnerable. I have written and applied
a patch against the system I am configuring, and posted a report, with the patch, to
bugtraq. I do not have the patch on me, so here are the detials of how it worked:

In the patch adds a security check to proc_follow_link in fs/oric/link.c; during the
scan find the init process table entry. Just before the switch add the follwing checks.

1. If init not found then return ENOENT.
2. If the current processes root is not the same as init's then
If the current processes root is not the same as the targetted process
return ENOENT.

I did include the iput operations in, before anyone asks. This transforms the links that
could be used to escape from the chroot() area into dangling links pointing nowhere
for those restricted. I use the patch to keep people within NFS mounted copies of the
usual stuff from localhost with irritating restructions like being exported read-only
added, uid o to 1000 being mapped to nobody, etc. Now I feel safe in assumming nobody
will be installing the rootkit (binaries are only exported ro, if you want to mount them
rw then though).

The slternative fix is to only allow /proc to be mounted once.
(Oops! I should have said only allow mounting of the proc filing system once).

Kudos for msking mknod useless to squashed superusers.

Duncan (-:

 \ /
  Last update: 2005-03-22 13:40    [W:0.048 / U:19.576 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site