From: Lennart Poettering <mzxreary@0pointer.de>
To: linux-kernel@vger.kernel.org
Subject: Can access to /proc/$PID/exe be relaxed?
Date: Tue, 21 Jul 2009 18:52:48 +0200 [thread overview]
Message-ID: <20090721165248.GA27549@tango.0pointer.de> (raw)
Hi!
Unless I am mistaken a process currently needs CAP_SYS_PTRACE to read
/proc/$PID/exe for abritrary processes. Does that make sense? Could
that be relaxed? Is there any reason to limit access to that link at
all? To me the data from /proc/$PID/cmdline seems to be far more
worthy to be protected than /proc/$PID/exe, or am I missing something?
Tbh, looking at the code I don't really get where CAP_SYS_PTRACE seems
to be required, but experimenting from userspace this seems to be the
case.
Lennart
--
Lennart Poettering Red Hat, Inc.
lennart [at] poettering [dot] net
http://0pointer.net/lennart/ GnuPG 0x1A015CC4
next reply other threads:[~2009-07-21 16:53 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2009-07-21 16:52 Lennart Poettering [this message]
2009-07-21 17:06 ` Can access to /proc/$PID/exe be relaxed? Denys Vlasenko
2009-07-21 17:17 ` Lennart Poettering
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20090721165248.GA27549@tango.0pointer.de \
--to=mzxreary@0pointer.de \
--cc=linux-kernel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.