Messages in this thread | | | Date | Tue, 20 Mar 2012 03:12:12 +0400 | From | Cyrill Gorcunov <> | Subject | Re: [patch 1/2] c/r: prctl: Add ability to set new mm_struct::exe_file |
| |
On Mon, Mar 19, 2012 at 03:59:26PM -0700, Andrew Morton wrote: ... > > > > It can use it iif CAP_SYS_RESOURCE is granted. > > Otherwise you'll get -eaccess. > > A rootkit already obtained CAP_SYS_RESOURCE. What we're concerned > about here is its ability to hide itself from view and its ability to > obscure the way in which it obtained elevated privs.
Well, if rootkit got CAP_SYS_RESOURCE I think we're in bad situation then -- it might change the symlink to some 'known' and trusted application and you'll never notice that (without scanning the memory area such rootkit uses, and note 'scanning' here because you need to scan for memory contents to figure out that memory do not correspond the file symlinks point to).
Actually being able to restore program 'transparently' is a primary aim of checkpoint-restore itself.
> > How much this patch worsens the situation is unclear to me, so let's > think it through.
Dunno Andrew, /proc/exe/symlink is never trusted source of info I guess. But I need to think some more...
Cyrill
| |