lkml.org 
[lkml]   [1998]   [Aug]   [4]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH] [SECURITY] suid procs exec'd with bad 0,1,2 fds

Actually there would be people to object to that: when in use it slows
things down (at least things that execute on the stack). Putting that in
requires about all of the code in the current patch.

How about this:

1) Rework the patch so that it modifies very little of the
kernel (if that's not been done already, I have not used them in a while).

2) Include the whole things with various level's of protection.

Prob after 2.2 comes out most dist's will begin shipping multiple kernels
again so the user just takes their pick:

* Normal
* SMP
* Fireproof :)

With sutible warnings that fireproof might not be compatible with all
software and you're at your own risk.

On Tue, 4 Aug 1998, Peter T. Breuer wrote:

> "A month of sundays ago Alan Cox wrote:"
> >
> > One good thing it does is leave your log file full of messages about the
> > attempts. Its very visible when you get attacked
>
> Well that would appear to be an uncontentious benefit then, and why not
> have that kind of "level 0" protection in? I'm sure nobody would object to
> that.
>
>
> My 2c. Why I took the non-exec patches out originally was:
>
> 1) I had version 1 of the patch, it broke gdb although it said it wouldn't,
> and I didn't know there was a version 2 (where?).
>
> 2) It changes what might be said to be the heart of the kernel: loading
> and executing code. I wasn't honestly able to maintain a change like
> that while everybody else was building against a different stack
> behaviour - I hardly understood the trampoline work-around. I
> already had problems with gdb, and I thought I had problems with java
> and ml and python (as I recall). I saw differences between compiled and
> interpreted codes that should not have happened. I have felt less
> nervous since removing the patch from my source copy. It simplified
> life.
>
> Peter ptb@it.uc3m.es
>
> -
> To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
> the body of a message to majordomo@vger.rutgers.edu
> Please read the FAQ at http://www.altern.org/andrebalsa/doc/lkml-faq.html
>


-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.altern.org/andrebalsa/doc/lkml-faq.html

\
 
 \ /
  Last update: 2005-03-22 13:43    [W:0.092 / U:0.088 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site