linux-kernel - Re: [PATCH] prctl: remove one-shot limitation for changing exe link

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20160718211155.393aca3c@lxorguk.ukuu.org.uk>
Date:	Mon, 18 Jul 2016 21:11:55 +0100
From:	One Thousand Gnomes <gnomes@...rguk.ukuu.org.uk>
To:	ebiederm@...ssion.com (Eric W. Biederman)
Cc:	Cyrill Gorcunov <gorcunov@...il.com>,
	Stanislav Kinsburskiy <skinsbursky@...tuozzo.com>,
	peterz@...radead.org, mingo@...hat.com, mhocko@...e.com,
	keescook@...omium.org, linux-kernel@...r.kernel.org,
	mguzik@...hat.com, bsegall@...gle.com, john.stultz@...aro.org,
	oleg@...hat.com, matthltc@...ibm.com, akpm@...ux-foundation.org,
	luto@...capital.net, vbabka@...e.cz, xemul@...tuozzo.com
Subject: Re: [PATCH] prctl: remove one-shot limitation for changing exe link

> >> 1) Attach to process via ptrace (protected by CAP_SYS_PTRACE)
> >> 2) Unmap all the process file mappings, related to "exe" file.
> >> 3) Change exe link (protected by CAP_SYS_RESOURCE).
> >> 
> >> IOW, some other process already has an access to process internals (and thus
> >> it's already compromised), and can inject fork and use the child of the
> >> compromised program to masquerade.
> >> Which means this limitation doesn't solve the problem it was aimed to.

IFF it is the same uid or root (in which case you already lost). In the
case of cross uid activity this is not true.

Alan