From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752565AbcGRUOA (ORCPT ); Mon, 18 Jul 2016 16:14:00 -0400 Received: from lxorguk.ukuu.org.uk ([81.2.110.251]:51936 "EHLO lxorguk.ukuu.org.uk" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752384AbcGRUN7 (ORCPT ); Mon, 18 Jul 2016 16:13:59 -0400 Date: Mon, 18 Jul 2016 21:11:55 +0100 From: One Thousand Gnomes To: ebiederm@xmission.com (Eric W. Biederman) Cc: Cyrill Gorcunov , Stanislav Kinsburskiy , peterz@infradead.org, mingo@redhat.com, mhocko@suse.com, keescook@chromium.org, linux-kernel@vger.kernel.org, mguzik@redhat.com, bsegall@google.com, john.stultz@linaro.org, oleg@redhat.com, matthltc@us.ibm.com, akpm@linux-foundation.org, luto@amacapital.net, vbabka@suse.cz, xemul@virtuozzo.com Subject: Re: [PATCH] prctl: remove one-shot limitation for changing exe link Message-ID: <20160718211155.393aca3c@lxorguk.ukuu.org.uk> In-Reply-To: <87inwa2406.fsf@x220.int.ebiederm.org> References: <20160712152940.24895.61315.stgit@localhost.localdomain> <20160712164800.GD3661@uranus.lan> <87inwa2406.fsf@x220.int.ebiederm.org> Organization: Intel Corporation X-Mailer: Claws Mail 3.13.2 (GTK+ 2.24.30; x86_64-redhat-linux-gnu) MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org > >> 1) Attach to process via ptrace (protected by CAP_SYS_PTRACE) > >> 2) Unmap all the process file mappings, related to "exe" file. > >> 3) Change exe link (protected by CAP_SYS_RESOURCE). > >> > >> IOW, some other process already has an access to process internals (and thus > >> it's already compromised), and can inject fork and use the child of the > >> compromised program to masquerade. > >> Which means this limitation doesn't solve the problem it was aimed to. IFF it is the same uid or root (in which case you already lost). In the case of cross uid activity this is not true. Alan