From: Phillip Susi <psusi@cfl.rr.com>
To: Linus Torvalds <torvalds@osdl.org>
Cc: Steven Rostedt <rostedt@goodmis.org>,
Nick Warne <nick@linicks.net>,
Felipe Alfaro Solana <felipe.alfaro@gmail.com>,
linux-kernel@vger.kernel.org
Subject: Re: chmod 111
Date: Fri, 17 Mar 2006 14:38:13 -0500 [thread overview]
Message-ID: <441B1025.7000708@cfl.rr.com> (raw)
In-Reply-To: <Pine.LNX.4.64.0603171036240.3618@g5.osdl.org>
Linus Torvalds wrote:
> In particular, it's fairly easy to create a shared library that replaces a
> system library (LD_LIBRARY_PATH) and then just dumps out the binary image.
>
What prevents you from injecting a shared library and manipulating a
suid executable? Does the environment get cleared when you exec a suid
program? Or does the dynamic linker just notice euid != uid and ignore
the LD environment variables? If so then would adding the sgid bit and
making the binary owned by a powerless group effectively prevent this
attack vector to read it?
next prev parent reply other threads:[~2006-03-17 19:40 UTC|newest]
Thread overview: 15+ messages / expand[flat|nested] mbox.gz Atom feed top
2006-03-17 17:46 chmod 111 Nick Warne
[not found] ` <6f6293f10603171007vbf752e5n8a3d6f2d65e0a1e7@mail.gmail.com>
2006-03-17 18:11 ` Nick Warne
2006-03-17 18:26 ` Steven Rostedt
2006-03-17 18:43 ` Linus Torvalds
2006-03-17 18:55 ` Steven Rostedt
2006-03-17 21:44 ` Jan Engelhardt
2006-03-18 12:42 ` Nick Warne
2006-03-17 19:38 ` Phillip Susi [this message]
2006-03-17 20:11 ` Linus Torvalds
2006-03-17 20:27 ` Nick Warne
2006-03-17 20:56 ` Willy Tarreau
2006-03-18 14:09 ` Helge Hafting
2006-03-17 18:12 ` Joshua Hudson
[not found] ` <441AFBF5.7010009@tlinx.org>
2006-03-17 18:14 ` Nick Warne
2006-03-17 18:18 ` Phillip Susi
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=441B1025.7000708@cfl.rr.com \
--to=psusi@cfl.rr.com \
--cc=felipe.alfaro@gmail.com \
--cc=linux-kernel@vger.kernel.org \
--cc=nick@linicks.net \
--cc=rostedt@goodmis.org \
--cc=torvalds@osdl.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox