Messages in this thread | | | Subject | Re: Time to remove LSM (was Re: [RESEND][RFC][PATCH 2/7] implementation of LSM hooks) | From | Valdis.Kletnieks@vt ... | Date | Sun, 23 Apr 2006 05:33:28 -0400 |
| |
On Sat, 22 Apr 2006 20:50:15 PDT, Crispin Cowan said: >> What happens if I ln /bin/stty /tmp/evilstty, then exploit >> vulnerability in stty?
A crucial point here is that the 'ln' and the actual exploit don't have to be firmly attached to each other...
If you can get *any* unconfined user to do that 'ln' (Hmm... have you checked if your tar/cpio/pax/etc have been patched to prohibit this when you extract an archive?), then the exploit can be run *even in a domain that can't do the ln that set it up*.
> This is a really basic misunderstanding of AppArmor. All unconfined > processes are considered trusted, so attacks that suppose an unconfined > user did something very evil/stupid are not interesting.
Unfortunately, in the *real* world, "unconfined user accidentally runs malware that sets up the conditions for a later exploit" is an actual real problem. I'm sorry to see that it's just swept under the rug as "not interesting".
Now, if you changed "not interesting" to "so damned hard we couldn't figure out how to deal with it", I'd have a bit of sympathy for the position... ;)
[unhandled content-type:application/pgp-signature] | |