Messages in this thread | | | Date | Fri, 17 Mar 2006 14:38:13 -0500 | From | Phillip Susi <> | Subject | Re: chmod 111 |
| |
Linus Torvalds wrote: > In particular, it's fairly easy to create a shared library that replaces a > system library (LD_LIBRARY_PATH) and then just dumps out the binary image. >
What prevents you from injecting a shared library and manipulating a suid executable? Does the environment get cleared when you exec a suid program? Or does the dynamic linker just notice euid != uid and ignore the LD environment variables? If so then would adding the sgid bit and making the binary owned by a powerless group effectively prevent this attack vector to read it?
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |