lkml.org 
[lkml]   [2011]   [May]   [26]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH 3/5] v2 seccomp_filters: Enable ftrace-based system call filtering

* Linus Torvalds <torvalds@linux-foundation.org> wrote:

> And if you filter system calls, it's entirely possible that you can
> attack suid executables through such a vector. Your "limit system
> calls for security" security suddenly turned into "avoid the system
> call that made things secure"!

That should not be possible with Will's event filter based solution
(his last submitted patch), due to this code in fs/exec.c (which is
in your upstream tree as well):

/*
* Flush performance counters when crossing a
* security domain:
*/
if (!get_dumpable(current->mm))
perf_event_exit_task(current);

This will drop all filters if a setuid-root (or whatever setuid)
binary is executed from a filtered environment.

Does this cover the case you were thinking of?

Thanks,

Ingo


\
 
 \ /
  Last update: 2011-05-26 20:57    [W:0.100 / U:31.228 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site