[lkml]   [1998]   [Nov]   [22]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    I'll assume no one else has seen this...

    Basically, it's a way to "trick" the kernel into sending SIGIO to any process.

    fs/fcntl.c:161... (2.1.126)
    case F_SETOWN:
    err = 0;
    filp-> = arg;
    filp->f_owner.uid = current->uid;
    filp->f_owner.euid = current->euid;
    if (S_ISSOCK (filp->f_dentry->d_inode->i_mode))
    err = sock_fcntl (filp, F_SETOWN, arg);

    Does no one else think that's just a little on the brain damaged side? No
    sanity checks what-so-ever in handing a filedesc to an arbitrary process
    number... no permissions check, no pid check, nothing.

    #define F_SETOWN 8 /* for sockets. */
    #define F_GETOWN 9 /* for sockets. */
    #define F_SETSIG 10 /* for sockets. */
    #define F_GETSIG 11 /* for sockets. */

    If they are "for sockets", then why isn't there any check to see that the
    filp actually is a socket before screwing with it? In fact, why isn't it
    in net/core/sock.c under sock_fcntl? And then why doesn't it set the uids
    to match arg?

    All very interesting questions.


    "This business is like the tobacco business. I wouldn't smoke for love or money
    but by god I'll sell the shit outa it..." -- Virgil Wall (re: Windows)

    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to
    Please read the FAQ at

     \ /
      Last update: 2005-03-22 13:45    [W:0.018 / U:8.416 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site