lkml.org 
[lkml]   [2012]   [Mar]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [patch 1/2] c/r: prctl: Add ability to set new mm_struct::exe_file
    On Mon, Mar 19, 2012 at 03:46:49PM -0700, Andrew Morton wrote:
    >
    > Please send a patch with the updated changelog and improved comment?

    Sure I'll resend.

    >
    > > >
    > > > Actually I liked multi-shot version more but Matt arguments convinced
    > > > me that one-short fashion is more "secure" in terms of overall kernel
    > > > state and potential transitions/changes of this /proc/pid/exe symlink.
    > > >
    > > > At least with one-shot version the admin may be sure that the symlink
    > > > is never changed more than once, ever.
    > > >
    > >
    > > And changing it once does not harm security?
    > > I'm sure that rootkit writers will like this feature...
    >
    > Well, let's discuss this more completely. In what ways could an
    > attacker use this? How serious is the problem? What actions can be
    > taken to lessen it? etcetera.

    It can use it iif CAP_SYS_RESOURCE is granted.
    Otherwise you'll get -eaccess.

    Cyrill


    \
     
     \ /
      Last update: 2012-03-19 23:53    [W:0.021 / U:119.072 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site