[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <YhYbcF7Iy9rwr3V5@momentum.pseudorandom.co.uk>
Date: Wed, 23 Feb 2022 11:33:04 +0000
From: Simon McVittie <smcv@...ian.org>
To: oss-security@...ts.openwall.com
Subject: Re: CVE-2021-44731: Race condition in snap-confine's
setup_private_mount()
On Wed, 23 Feb 2022 at 08:54:49 +0100, Wire Snark wrote:
> Why it isn't possible to copy the snap-confine binary into a directory
> for the same effect -- instead of hardlinking it?
If you copy a file you don't own, then the copy is owned by you, and has
permissions controlled by you: in particular, if you're not root, then the
copy can't be setuid root.
If you hard-link a file you don't own (which some kernel configurations
don't allow), then that filename points to the same inode as the original
filename, so it has the same ownership and permissions as the original file
(and in particular it's still setuid root).
smcv
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
