lkml.org 
[lkml]   [2012]   [Mar]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [patch 1/2] c/r: prctl: Add ability to set new mm_struct::exe_file
On Mon, Mar 19, 2012 at 03:59:26PM -0700, Andrew Morton wrote:
...
> >
> > It can use it iif CAP_SYS_RESOURCE is granted.
> > Otherwise you'll get -eaccess.
>
> A rootkit already obtained CAP_SYS_RESOURCE. What we're concerned
> about here is its ability to hide itself from view and its ability to
> obscure the way in which it obtained elevated privs.

Well, if rootkit got CAP_SYS_RESOURCE I think we're in bad situation
then -- it might change the symlink to some 'known' and trusted
application and you'll never notice that (without scanning the
memory area such rootkit uses, and note 'scanning' here because
you need to scan for memory contents to figure out that memory
do not correspond the file symlinks point to).

Actually being able to restore program 'transparently' is a primary
aim of checkpoint-restore itself.

>
> How much this patch worsens the situation is unclear to me, so let's
> think it through.

Dunno Andrew, /proc/exe/symlink is never trusted source of info I guess.
But I need to think some more...

Cyrill


\
 
 \ /
  Last update: 2012-03-20 00:15    [W:0.062 / U:0.052 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site