linux-kernel - Re: [patch 1/2] c/r: prctl: Add ability to set new mm_struct::exe

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 20 Mar 2012 03:12:12 +0400
From:	Cyrill Gorcunov <gorcunov@...nvz.org>
To:	Andrew Morton <akpm@...ux-foundation.org>
Cc:	richard -rw- weinberger <richard.weinberger@...il.com>,
	LKML <linux-kernel@...r.kernel.org>,
	Oleg Nesterov <oleg@...hat.com>,
	KOSAKI Motohiro <kosaki.motohiro@...fujitsu.com>,
	Pavel Emelyanov <xemul@...allels.com>,
	Kees Cook <keescook@...omium.org>, Tejun Heo <tj@...nel.org>,
	Matt Helsley <matthltc@...ibm.com>
Subject: Re: [patch 1/2] c/r: prctl: Add ability to set new
 mm_struct::exe_file

On Mon, Mar 19, 2012 at 03:59:26PM -0700, Andrew Morton wrote:
...
> > 
> > It can use it iif CAP_SYS_RESOURCE is granted.
> > Otherwise you'll get -eaccess.
> 
> A rootkit already obtained CAP_SYS_RESOURCE.  What we're concerned
> about here is its ability to hide itself from view and its ability to
> obscure the way in which it obtained elevated privs.

Well, if rootkit got CAP_SYS_RESOURCE I think we're in bad situation
then -- it might change the symlink to some 'known' and trusted
application and you'll never notice that (without scanning the
memory area such rootkit uses, and note 'scanning' here because
you need to scan for memory contents to figure out that memory
do not correspond the file symlinks point to).

Actually being able to restore program 'transparently' is a primary
aim of checkpoint-restore itself.

> 
> How much this patch worsens the situation is unclear to me, so let's
> think it through.

Dunno Andrew, /proc/exe/symlink is never trusted source of info I guess.
But I need to think some more...

	Cyrill
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/