lkml.org 
[lkml]   [2012]   [Mar]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [patch 1/2] c/r: prctl: Add ability to set new mm_struct::exe_file
On Mon, Mar 19, 2012 at 03:46:49PM -0700, Andrew Morton wrote:
>
> Please send a patch with the updated changelog and improved comment?

Sure I'll resend.

>
> > >
> > > Actually I liked multi-shot version more but Matt arguments convinced
> > > me that one-short fashion is more "secure" in terms of overall kernel
> > > state and potential transitions/changes of this /proc/pid/exe symlink.
> > >
> > > At least with one-shot version the admin may be sure that the symlink
> > > is never changed more than once, ever.
> > >
> >
> > And changing it once does not harm security?
> > I'm sure that rootkit writers will like this feature...
>
> Well, let's discuss this more completely. In what ways could an
> attacker use this? How serious is the problem? What actions can be
> taken to lessen it? etcetera.

It can use it iif CAP_SYS_RESOURCE is granted.
Otherwise you'll get -eaccess.

Cyrill


\
 
 \ /
  Last update: 2012-03-19 23:53    [from the cache]
©2003-2011 Jasper Spaans