Re: [PATCH] Add prctl to modify current->comm

[Alan Cox <alan@lxorguk.ukuu.org.uk>]

On Maw, 2004-09-07 at 15:27, Andi Kleen wrote:
> I considered the potential security issues of a program obscuring
> itself with this interface, but I don't think it matters much
> because a program can already obscure itself when the admin uses
> ps instead of top. In case of a KDE desktop calling everything
> kdeinit is much more obfuscation than the alternative.

Actually its a lot simpler than that.  I long ago as a student wrong a
shell which simply did ln [binarytorun] banana; execve(.."banana", ...)

So I agree its not security related. You just need to fix the
implementation

> +		case PR_SET_NAME: {
> +			struct task_struct *me = current;
> +			me->comm[sizeof(me->comm)-1] = 0;
> +			if (strncpy_from_user(me->comm, (char *)arg2, sizeof(me->comm)-1) < 0)
> +				return -EFAULT;
> +			return 0;
> +		}

If the strncpy_from_user faults the state of current->comm is undefined.
This strikes me as bad design.

Alan