From: Tycho Andersen <tycho@tycho.pizza>
To: "Eric W. Biederman" <ebiederm@xmission.com>
Cc: "Kees Cook" <kees@kernel.org>,
"Alexander Viro" <viro@zeniv.linux.org.uk>,
"Christian Brauner" <brauner@kernel.org>,
"Jan Kara" <jack@suse.cz>,
linux-fsdevel@vger.kernel.org, linux-mm@kvack.org,
linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org,
"Tycho Andersen" <tandersen@netflix.com>,
"Zbigniew Jędrzejewski-Szmek" <zbyszek@in.waw.pl>,
"Aleksa Sarai" <cyphar@cyphar.com>
Subject: Re: [PATCH v2 1/2] exec: add a flag for "reasonable" execveat() comm
Date: Tue, 1 Oct 2024 07:43:37 -0600 [thread overview]
Message-ID: <Zvv8iWjZQ/cE4LLa@tycho.pizza> (raw)
In-Reply-To: <871q10vr62.fsf@email.froward.int.ebiederm.org>
On Mon, Sep 30, 2024 at 03:10:29PM -0500, Eric W. Biederman wrote:
> "Eric W. Biederman" <ebiederm@xmission.com> writes:
>
> > Kees Cook <kees@kernel.org> writes:
>
> >> I'm not super comfortable doing this regardless of bprm->fdpath; that
> >> seems like too many cases getting changed. Can we just leave it as
> >> depending on bprm->fdpath?
>
> I was recommending that because I did not expect that there was any
> widespread usage of aliasing of binary names using symlinks.
>
> I realized today that on debian there are many aliases
> of binaries created with the /etc/alternatives mechanism.
> So there is much wider exposure to problems than I would have
> supposed.
>
> So I remove any objections to making the new code conditional on bprm->fdpath.
Yep, and it looks like Alpine distributes busybox with symlinks
instead of hard links. I will respin with a fixed subject line shortly.
Thanks,
Tycho
prev parent reply other threads:[~2024-10-01 13:43 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-09-27 15:17 [PATCH v2 1/2] exec: add a flag for "reasonable" execveat() comm Tycho Andersen
2024-09-27 15:17 ` [PATCH v2 2/2] selftests/exec: add a test to enforce execveat()'s comm Tycho Andersen
2024-09-27 15:45 ` [PATCH v2 1/2] exec: add a flag for "reasonable" execveat() comm Eric W. Biederman
2024-09-28 21:56 ` Kees Cook
2024-09-30 2:59 ` Eric W. Biederman
2024-09-30 20:10 ` Eric W. Biederman
2024-10-01 13:43 ` Tycho Andersen [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=Zvv8iWjZQ/cE4LLa@tycho.pizza \
--to=tycho@tycho.pizza \
--cc=brauner@kernel.org \
--cc=cyphar@cyphar.com \
--cc=ebiederm@xmission.com \
--cc=jack@suse.cz \
--cc=kees@kernel.org \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-kselftest@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=tandersen@netflix.com \
--cc=viro@zeniv.linux.org.uk \
--cc=zbyszek@in.waw.pl \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.