Linux-kernel mailing list archive 1998-31,: Re: [PATCH] [SECURITY] suid procs exec'd with bad 0,1,2 fds

# Re: [PATCH] [SECURITY] suid procs exec'd with bad 0,1,2 fds

Perry Harrington (pedward@sun4.apsoft.com)
Tue, 4 Aug 1998 18:19:53 -0700 (PDT)

- Messages sorted by: [ date ][ thread ][ subject ][ author ]
- Next message: Dean Gaudet: "Re: [PATCH] [SECURITY] suid procs exec'd with bad 0,1,2 fds"
- Previous message: Brandon S. Allbery KF8NH: "Re: [PATCH] [SECURITY] suid procs exec'd with bad 0,1,2 fds"

>
> You can wait forever, or just try it on your system.
>
> Or sombody had better tell me why they shouldn't fix their broken
> applications.
>

Err, noatime, nodiratime, etc...

If you lived in south central LA, would you wait for the politicians to clean
up all the ruffians, or would you invest in a bulletproof vest?

Bulletproof vests don't protect you from head shots or extremity shots, but
they do a damn good job at protecting the 90% of places that idiots can hit you.

We've already established that:

A) /proc/whatever can be there to enable/disable stack protection by default
B) ELF bits *ARE* there for this such thing
C) it doesn't remove the issue, it provides additional notification (whereas you
have none currently) and provides some additional protection (whereas you have none
currently).

You keep going at it from "fix their broken applications", I'm going at it from
"kick their a** off the system because they were logged as attempting to break root".

They're 2 distinctly different issues.

We've already shown that this feature can be disabled.

You let noatime and nodiratime into the kernel.

Well, the noatime feature breaks /bin/login when it checks for new mail, it always
thinks you have new mail. You can enable/disable it at will -- the stack patch can
be done the same.

>
> Linus
>

--Perry

    --
    Perry Harrington       Linux rules all OSes.    APSoft      ()
    email: perry@apsoft.com 			Think Blue. /\

    -
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.rutgers.edu
    Please read the FAQ at http://www.altern.org/andrebalsa/doc/lkml-faq.html

- Next message: Dean Gaudet: "Re: [PATCH] [SECURITY] suid procs exec'd with bad 0,1,2 fds"
- Previous message: Brandon S. Allbery KF8NH: "Re: [PATCH] [SECURITY] suid procs exec'd with bad 0,1,2 fds"