Messages in this thread | | | Date | Sat, 24 May 2008 01:07:34 -0700 | From | Chris Wright <> | Subject | Re: capget() overflows buffers. |
| |
* Andrew G. Morgan (morgan@kernel.org) wrote: > Your concern is for the situation when the garbage happens to correspond > to an apparently meaningful setting for the upper capability bits? The > problem being that this privileged application is more privileged than > intended? I agree that this is not ideal.
Yep, exactly.
> In practice, however, this is only a real problem if named (or a > similarly structured program) has a security related bug in it. No?
It's dropped privileges to help mitigate any security related bug it may contain. It's conceivable (albeit remote[1]) that fork/exec plus inheritable could leak privs w/out a security related bug.
> Is this your concern, or have I missed something?
That's it.
thanks, -chris
[1] Get lucky combo in the garbage bits and have not shed uid 0. Much less likely.
| |