2 messages, 2 authors, 2018-12-12 · open the first message on its own page
From: Florian Weimer <hidden>
Date: 2018-12-12 20:13:26
* James Morris:
If you're depending on the script interpreter to flag that the user may execute code, this seems to be equivalent in security terms to depending on the user. e.g. what if the user uses ptrace and clears O_MAYEXEC?
The argument I've heard is this: Using ptrace (and adding the +x attribute) are auditable events. Florian
From: James Morris <jmorris@namei.org>
Date: 2018-12-12 23:40:59
On Wed, 12 Dec 2018, Florian Weimer wrote:
* James Morris:quoted
If you're depending on the script interpreter to flag that the user may execute code, this seems to be equivalent in security terms to depending on the user. e.g. what if the user uses ptrace and clears O_MAYEXEC?The argument I've heard is this: Using ptrace (and adding the +x attribute) are auditable events.
I guess you could also preload a modified libc which strips the flag. -- James Morris [off-list ref]