Re: [PATCH] 2-ptrace_multi

[Alan Cox <alan@lxorguk.ukuu.org.uk>]

On Gwe, 2006-05-19 at 22:17 +0200, Andi Kleen wrote:
> > I believe the conclusion, when this was last discussed, was that this
> > is not true and could be fixed.
> 
> iirc the main problem was mmap of /proc/*/mem. write can be probably 
> enabled after some auditing.
> 
> Alan hacked on this iirc so he might comment.

The stuff I hacked on was to solve the problem that "/proc/xxx/mem"
changed meaning while open. That is if you did opens on proc/self/mem
and passed the fd to someone they got *their own* /proc/self/mem. 

That can cause mayhem if you do

	fd = open /proc/self/mem
	dup(fd, 2);
	dup(fd, 1);
	seek to right spot
	exec setuid binary in a way it prints and self patches.

I think the general cases of write and mmap can probably be enabled with
care. Clearly you can do it via ptrace so therefore ptrace equivalent
permissions is a beginning point. Someone needs to audit the mm
implications carefully because the old DOSemu mmap of /proc/self trick
did break stuff and the write case might have similar problems.

Alan