Messages in this thread | | | Date | Tue, 20 Mar 2012 02:39:41 +0400 | From | Cyrill Gorcunov <> | Subject | Re: [patch 1/2] c/r: prctl: Add ability to set new mm_struct::exe_file |
| |
On Mon, Mar 19, 2012 at 03:15:07PM -0700, Andrew Morton wrote: ... > > > > Also this action is one-shot only. For security reason > > we don't allow to change the symlink several times. > > What is this mysterious "security reason"? >
Oh, sorry I should have included Matt's comment here
| Before this patch that state was rather ephemeral and almost entirely | under the control of the kernel. The only way userspace could change it | was by unmapping the region(s) mapped during exec*(). At that point it | could not "lie" and insert some other symlink there and the admin would | be better able to determine what had happened. | | With this patch -- especially the multi-shot form -- the symlink will | be entirely under the control of (potentially untrusted) userspace code | and the admin is totally at the mercy of the userspace code. In | single-shot form programs could use the prctl() to ensure the symlink | could not be changed later -- the restart tool would be the only program | that would need to ensure that prctl() had not been used since the last | exec*(). ... > > It should be explained here also. The comment is pretty useless - if > we don't tell people what this "security reason" is, how can future > developers be sure that they aren't violating it? >
Actually I liked multi-shot version more but Matt arguments convinced me that one-short fashion is more "secure" in terms of overall kernel state and potential transitions/changes of this /proc/pid/exe symlink.
At least with one-shot version the admin may be sure that the symlink is never changed more than once, ever.
Cyrill
| |