bugtraq - Re: Re: /proc filesystem allows bypassing directory permissions on Linux

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <200910261514.n9QFEUwr023032@www3.securityfocus.com>
Date: Mon, 26 Oct 2009 09:14:30 -0600
From: nomail@...ail.com
To: bugtraq@...urityfocus.com
Subject: Re: Re: /proc filesystem allows bypassing directory permissions
 on Linux

>> I do not think mounting /proc should change access control semantics.
>>
>It didn't in fact change anything. If the guest created hardlink to that file in a unrestricted location, what would you say?

Do your homework and test it. You can't create the hardlink - the link(oldpath, newpath) call will fail with EACCES if search permission is denied for any directory in oldpath or newpath. Documented in the manpage, and I just tested and verified it.

Fact is, directory permissions are relevant in Unix. Despite it's permissions, under the Unix access permission semantics the file is unwriteable for anyone but the owner, and this bug pokes a hole into that.