linux-kernel - Re: [PATCH 0/3] core_pattern: cleaned up repost/continuing post of core

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20070729155300.GC5794@piware.de>
Date:	Sun, 29 Jul 2007 17:53:00 +0200
From:	Martin Pitt <martin.pitt@...ntu.com>
To:	Eugene Teo <eteo@...hat.com>
Cc:	Neil Horman <nhorman@...driver.com>, linux-kernel@...r.kernel.org,
	akpm@...ux-foundation.org, jeremy@...p.org, martin.pitt@...ntu.com,
	wwoods@...hat.com
Subject: Re: [PATCH 0/3] core_pattern: cleaned up repost/continuing post of
	core_pattern enhancements

Hi Eugene,

Eugene Teo [2007-07-29 21:03 +0800]:
> >> Also, it is probably good to think how we can "drop privileges" while piping
> >> the core dump output to an external program. A malicious user can potentially
> >> use it as a possible backdoor since anything that is executed by "|program" will
> >> be executed with root privileges.
> >>
> > It was my understanding that apport already did this.
> 
> I haven't looked at apport yet, but are you talking about the userspace portion of
> apport or the kernel changes in the Ubuntu kernel?

Similarly to Neil's patches, the Ubuntu kernel calls the userspace
helper as root, too. Apport drops privileges to the target process as
soon as possible (there are a few things it needs to do before, like
opening an fd to the crash file in /var/crash/ if that is only
writeable by root).

Martin

-- 
Martin Pitt        http://www.piware.de
Ubuntu Developer   http://www.ubuntu.com
Debian Developer   http://www.debian.org

Download attachment "signature.asc" of type "application/pgp-signature" (190 bytes)