Re: [REVIEW][PATCH] exec: Don't exec files the userns root can not read.
From: Andy Lutomirski <luto@amacapital.net>
Date: 2016-10-19 15:30:14
Also in:
linux-fsdevel, lkml
Possibly related (same subject, not in this thread)
- 2016-10-19 · Re: [REVIEW][PATCH] exec: Don't exec files the userns root can not read. · Andy Lutomirski <luto@amacapital.net>
- 2016-10-19 · Re: [REVIEW][PATCH] exec: Don't exec files the userns root can not read. · Eric W. Biederman <hidden>
- 2016-10-19 · Re: [REVIEW][PATCH] exec: Don't exec files the userns root can not read. · Andy Lutomirski <luto@amacapital.net>
- 2016-10-19 · Re: [REVIEW][PATCH] exec: Don't exec files the userns root can not read. · Andy Lutomirski <luto@amacapital.net>
- 2016-10-19 · Re: [REVIEW][PATCH] exec: Don't exec files the userns root can not read. · Eric W. Biederman <hidden>
On Tue, Oct 18, 2016 at 2:15 PM, Eric W. Biederman [off-list ref] wrote:
When the user namespace support was merged the need to prevent ptracing an executable that is not readable was overlooked.
Before getting too excited about this fix, isn't there a much bigger hole that's been there forever? Simply ptrace yourself, exec the program, and then dump the program out. A program that really wants to be unreadable should have a stub: the stub is setuid and readable, but all the stub does is to exec the real program, and the real program should have mode 0500 or similar. ISTM the "right" check would be to enforce that the program's new creds can read the program, but that will break backwards compatibility. --Andy -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to majordomo@kvack.org. For more info on Linux MM, see: http://www.linux-mm.org/ . Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>