| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20090112155615.GA21350@ioremap.net> Date: Mon, 12 Jan 2009 18:56:15 +0300 From: Evgeniy Polyakov <zbr@...emap.net> To: Alan Cox <alan@...rguk.ukuu.org.uk> Cc: linux-kernel@...r.kernel.org, Andrew Morton <akpm@...ux-foundation.org>, Linus Torvalds <torvalds@...ux-foundation.org> Subject: Re: Linux killed Kenny, bastard! On Mon, Jan 12, 2009 at 03:52:39PM +0000, Alan Cox (alan@...rguk.ukuu.org.uk) wrote: > > Which has to be checked for every process ever created, > > which is quite unfeasible in some conditions. > > The task name is not a reliable indicator of true name and truncated so > is useless. You only nominate one task, you don't integrate with the > existing interface. Not one, but tasks which have the given string in the name. Like script names spawned at DoS time. > What you actually need is notifiers to work on /proc (exactly the same as > we need to avoid the bogus waitfd crap). At that point you can implement > arbitary policy by using dnotify/inotify/etc on /proc. Yes, it could be done. If inotify will not be killed itself, will be enabled in the config and daemon will be started. But right now there is no way to solve that task, in the long term this is a good idea to implement modulo security problems it may concern. -- Evgeniy Polyakov -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists