Re: [PATCH] prctl: remove one-shot limitation for changing exe link

[Stanislav Kinsburskiy]

18.07.2016 22:11, One Thousand Gnomes ÐÐÑÐÑ:
> > > > 1) Attach to process via ptrace (protected by CAP_SYS_PTRACE)
> > > > 2) Unmap all the process file mappings, related to "exe" file.
> > > > 3) Change exe link (protected by CAP_SYS_RESOURCE).
> > > >
> > > > IOW, some other process already has an access to process internals (and thus
> > > > it's already compromised), and can inject fork and use the child of the
> > > > compromised program to masquerade.
> > > > Which means this limitation doesn't solve the problem it was aimed to.
> IFF it is the same uid or root (in which case you already lost). In the
> case of cross uid activity this is not true.

Could you elaborate on it, please?

> Alan