| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <alpine.LFD.2.01.0907191241460.13838@localhost.localdomain> Date: Sun, 19 Jul 2009 12:47:25 -0700 (PDT) From: Linus Torvalds <torvalds@...ux-foundation.org> To: Athanasius <link@...gy.org> cc: linux-kernel <linux-kernel@...r.kernel.org>, Julien TINNES <jt@....org>, Greg KH <gregkh@...e.de>, Tavis Ormandy <taviso@....lonestar.org>, Christoph Hellwig <hch@...radead.org>, Kees Cook <kees@...ntu.com>, Eugene Teo <eugene@...hat.com> Subject: Re: [link@...gy.org: Re: [patch 2/8] personality: fix PER_CLEAR_ON_SETID (CVE-2009-1895)] On Sun, 19 Jul 2009, Athanasius wrote: > > Would you agree that having these features default-off would be best? I'm actually pretty sure that some glibc versions in particular have actively used some of the personality bits. I have this fairly clear memory of seeing 'personality()' system calls in strace output from regular programs. I just tested it, and I'm not seeing it in my current distro for normal programs, but the point is, I'm pretty sure that we have real binaries out there that depend on personality bits. So we can't default-off the whole personality thing. We would have to default-off just a subset of the bits. Would that be useful? Perhaps. Linus -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists