Re: [PATCH] 2-ptrace_multi
From: Alan Cox
Date: Sat May 20 2006 - 11:17:44 EST
On Gwe, 2006-05-19 at 22:17 +0200, Andi Kleen wrote:
> > I believe the conclusion, when this was last discussed, was that this
> > is not true and could be fixed.
> iirc the main problem was mmap of /proc/*/mem. write can be probably
> enabled after some auditing.
> Alan hacked on this iirc so he might comment.
The stuff I hacked on was to solve the problem that "/proc/xxx/mem"
changed meaning while open. That is if you did opens on proc/self/mem
and passed the fd to someone they got *their own* /proc/self/mem.
That can cause mayhem if you do
fd = open /proc/self/mem
seek to right spot
exec setuid binary in a way it prints and self patches.
I think the general cases of write and mmap can probably be enabled with
care. Clearly you can do it via ptrace so therefore ptrace equivalent
permissions is a beginning point. Someone needs to audit the mm
implications carefully because the old DOSemu mmap of /proc/self trick
did break stuff and the write case might have similar problems.
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/