Messages in this thread | | | Subject | Re: [PATCH] Add prctl to modify current->comm | From | Alan Cox <> | Date | Tue, 07 Sep 2004 18:12:48 +0100 |
| |
On Maw, 2004-09-07 at 15:27, Andi Kleen wrote: > I considered the potential security issues of a program obscuring > itself with this interface, but I don't think it matters much > because a program can already obscure itself when the admin uses > ps instead of top. In case of a KDE desktop calling everything > kdeinit is much more obfuscation than the alternative.
Actually its a lot simpler than that. I long ago as a student wrong a shell which simply did ln [binarytorun] banana; execve(.."banana", ...)
So I agree its not security related. You just need to fix the implementation
> + case PR_SET_NAME: { > + struct task_struct *me = current; > + me->comm[sizeof(me->comm)-1] = 0; > + if (strncpy_from_user(me->comm, (char *)arg2, sizeof(me->comm)-1) < 0) > + return -EFAULT; > + return 0; > + }
If the strncpy_from_user faults the state of current->comm is undefined. This strikes me as bad design.
Alan - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |