[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20110615153845.GA10715@albatros>
Date: Wed, 15 Jun 2011 19:38:45 +0400
From: Vasiliy Kulikov <segoon@...nwall.com>
To: kernel-hardening@...ts.openwall.com
Subject: Re: HARDEN_VM86
Solar,
On Wed, Jun 15, 2011 at 18:38 +0400, Solar Designer wrote:
> If upstream is fine with sysctl's setting gids, and this appears to be
> the case, then let's go for this.
I see one problem with gid style - as gid is a per pid_namespace thing,
it should be configurable per pid_namespace.
But on the other hand, a potential bug might lead to a privilege
escalation (not a in-namespace root, but e.g. arbitrary write into any
physical address) due to the nature of the syscall. So, in-namespace
root shouldn't be able to configure who is able to do vm86(2), otherwise
it is able to gain full root.
I'm confused :\
--
Vasiliy
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
