[lkml]   [2012]   [Mar]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: [patch 1/2] c/r: prctl: Add ability to set new mm_struct::exe_file
On Mon, Mar 19, 2012 at 11:41:36PM +0100, richard -rw- weinberger wrote:
> >
> > Actually I liked multi-shot version more but Matt arguments convinced
> > me that one-short fashion is more "secure" in terms of overall kernel
> > state and potential transitions/changes of this /proc/pid/exe symlink.
> >
> > At least with one-shot version the admin may be sure that the symlink
> > is never changed more than once, ever.
> >
> And changing it once does not harm security?
> I'm sure that rootkit writers will like this feature...

The one-shot limits the amount of transitions, but you still
have to obtain CAP_SYS_RESOURCE before you'll be able to change
this symlink (ie it's not 'anyone-can-change-it' feature).


 \ /
  Last update: 2012-03-19 23:51    [W:0.076 / U:0.344 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site