[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <422e80eccf76a8937d3528c3cfe52aa2@ispras.ru>
Date: Tue, 13 Oct 2020 19:52:28 +0300
From: Alexey Izbyshev <izbyshev@...ras.ru>
To: musl@...ts.openwall.com
Subject: Re: Calling setxid() in a vfork()-child
On 2020-10-12 23:30, Alexey Izbyshev wrote:
> ...However, thinking about it
> more, I see that dropping privileges could open the child to new ways
> of interaction from outside of the app in a window before execve(),
> so, if, say, another unprivileged process can ptrace it at the right
> moment, bad things could happen.
>
Alexander Monakov pointed out to me that this particular naive attack is
not possible (unless "/proc/sys/fs/suid_dumpable" is changed or the
application resets "dumpable" bit via prctl() after setxid()):
https://elixir.bootlin.com/linux/v5.9/source/kernel/cred.c#L466
Alexey
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
