On Fri, 21 Jul 2000, Myrddin Emrys wrote:
> On Fri, 21 Jul 2000 00:44:10 -0700 (PDT) you sent this message:
>
> >On Fri, 21 Jul 2000, Oliver Xymoron wrote:
> >
> >> No, of course not, but we also don't want to make large changes to the
> >> kernel to paper over a hole that we can't cement closed. Especially now.
> >
> >Here is you damn steel-plate-of-armor!
> <snip>
> >Damn-it here is you CEMENT!!!!!!!!!
>
> It's cement for one hole that you know exists... what about a dozen others
> you don't? There's probably two dozen documented other places where you can
> fry some subsystem or another. Protecting the system against a malicious
> root is an exercise in futility. No matter what you do, how you guard the
> system, root can bypass it. This is by design, as you well know. That is how
> Linux (and most *nix) works.
>
> As oxy said, not now. Propose the patch after the next stable release.
Brain dead are we, now that I know the argument better.....
> > > Can disk-destroyer be pushed into a shellstack because it is so small?
> > >
> > Yes, it's true. It can be made even smaller, much smaller, than the
> > compiled size of the code. Although the limits on how much shellcode
> > you can send in a buffer overrun do vary, I expect this will almost
> > certainly fit in just about every buffer overrun I've seen.
Here is your SECURITY HOLE!
JOE-SIX-PACK-HACKER can fry your butt.
Cheer,
Andre Hedrick
The Linux ATA/IDE guy
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/
This archive was generated by hypermail 2b29 : Sun Jul 23 2000 - 21:00:16 EST