bugtraq - Re: /proc filesystem allows bypassing directory permissions on Linux

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <4AE614A5.5000108@lightwave.net.ru>
Date: Tue, 27 Oct 2009 00:29:09 +0300
From: Dan Yefimov <dan@...htwave.net.ru>
To: nomail@...ail.com
Cc: bugtraq@...urityfocus.com
Subject: Re: /proc filesystem allows bypassing directory permissions on Linux

On 26.10.2009 18:14, nomail@...ail.com wrote:
>>> I do not think mounting /proc should change access control semantics.
>>>
>> It didn't in fact change anything. If the guest created hardlink to that file in
 >> a unrestricted location, what would you say?
>
> Do your homework and test it. You can't create the hardlink - the link(oldpath,
 > newpath) call will fail with EACCES if search permission is denied for any
 > directory in oldpath or newpath. Documented in the manpage, and I just tested
 > and verified it.
>
Good boy. However, there wasn't worth both citing well known facts to me and 
testing them. Remember the scenario from the original mail and try finding a 
window, during which creating a hardlink would still work thus evading directory 
permissions check.
-- 

Sincerely Your, Dan.