bugtraq - Re: /proc filesystem allows bypassing directory permissions on Linux

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <4AE33BE4.2010404@lightwave.net.ru>
Date: Sat, 24 Oct 2009 21:39:48 +0400
From: Dan Yefimov <dan@...htwave.net.ru>
To: anton.ivanov@...-begemot.co.uk
Cc: Matthew Bergin <matt.bergin@...mail.com>,
	bugtraq@...urityfocus.com
Subject: Re: /proc filesystem allows bypassing directory permissions	on	Linux

On 24.10.2009 20:59, Anton Ivanov wrote:
>> Not to tell about
>> that /proc/<PID>/fd/ contains only symbolic links, not files, so I can't
>> understand, how the original reporter managed to gain access to the file in the
>> restricted directory using that symlink.
>
> The perms are definitely broken and without a code audit on procfs I
> would not bet that this is limited just to this rather obscure test
> case.
>
> To be honest, I hope that it is limited to this rather obscure test
> case. If it is not there may be entertaining ramifications.
>
Given my citation above (I personally use Linux), that obscure test case looks 
doubtful. If the original reporter uses some patched kernel, that doesn't matter 
others.
-- 

Sincerely Your, Dan.