lkml.org 
[lkml]   [2022]   [Feb]   [1]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: [PATCH] fs/exec: require argv[0] presence in do_execveat_common()
From
Date
> I'm not really opposed  to attempting to change this with consensus
> (like, actually proposing it on the Austin Group tracker), but a less
> invasive change would be just enforcing it for the case where exec is
> a privilege boundary (suid/sgid/caps). There's really no motivation
> for changing longstanding standard behavior in a
> non-privilege-boundary case.

I don't really see it as a matter of "maintaining standard behavior".

there are very little uses for this ABI feature to be present and only
serves to make applications harder to port between Linux and other *nix
systems. The pros (major vulnerabilities like CVE-2021-4034) outweigh
the cons (minor userland ABI change that only affects shellcode on
shell-storm.org) in this particular scenario, and I am all for this patch.

\
 
 \ /
  Last update: 2022-02-01 21:55    [W:0.101 / U:1.576 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site