On Thu, 2007-06-21 at 19:25 +0200, Alexander Wuerstlein wrote:
> On 070621 19:21, Arjan van de Ven <[email protected]> wrote:
> > On Thu, 2007-06-21 at 18:02 +0200, Alexander Wuerstlein wrote:
> > > Modified task_struct to hold a 'signed flag' which is set on exec(), inherited
> > > on fork() and checked during exec before giving the new process suid/sgid
> > > privileges.
> > >
> >
> >
> >
> > do you also check the signature of glibc and every other shared library
> > that the app uses (or dlopens)? if not.. the entire exercise is rather
> > pointless...
>
> We do check that, that is patch [3/4].
>
> Of course we can only check mmap-ed files, if there is no file like with JIT
> compilers we are out of luck.
or if the process uses read() not mmap().
or .. or ...
so if perl is signed and it's the perl script that is setuid, and then
it includes other perl libs... that's read() not mmap().
--
if you want to mail me at work (you don't), use arjan (at) linux.intel.com
Test the interaction between Linux and your BIOS via http://www.linuxfirmwarekit.org
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[Index of Archives]
[Kernel Newbies]
[Netfilter]
[Bugtraq]
[Photo]
[Stuff]
[Gimp]
[Yosemite News]
[MIPS Linux]
[ARM Linux]
[Linux Security]
[Linux RAID]
[Video 4 Linux]
[Linux for the blind]
[Linux Resources]
