Re: [PATCH] prctl: remove one-shot limitation for changing exe link

From: Stanislav Kinsburskiy
Date: Wed Jul 20 2016 - 10:03:49 EST

18.07.2016 22:11, One Thousand Gnomes ÐÐÑÐÑ:
1) Attach to process via ptrace (protected by CAP_SYS_PTRACE)
2) Unmap all the process file mappings, related to "exe" file.
3) Change exe link (protected by CAP_SYS_RESOURCE).

IOW, some other process already has an access to process internals (and thus
it's already compromised), and can inject fork and use the child of the
compromised program to masquerade.
Which means this limitation doesn't solve the problem it was aimed to.
IFF it is the same uid or root (in which case you already lost). In the
case of cross uid activity this is not true.

Could you elaborate on it, please?