lkml.org 
[lkml]   [2017]   [Jul]   [7]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
Date
SubjectRe: [PATCH 0/2] exec: Use sane stack rlimit for setuid exec
On Fri, Jul 7, 2017 at 1:09 PM, Linus Torvalds
<torvalds@linux-foundation.org> wrote:
> On Fri, Jul 7, 2017 at 1:04 PM, Linus Torvalds
> <torvalds@linux-foundation.org> wrote:
>>
>> It looks like Kees went through the security modules [..]
>
> i take that back. It looks like Kees looked at smack, but not at
> SElinux, for example.

Well, I looked at the all but misthought about SELinux.

> selinux_bprm_secureexec() seems to just look at current_security(),
> not at the new stuff in bprm at all.

I was looking for cred. Yeah, I'll see what should happen here...

> Which would seem to be exactly the wrong thing to do, and is insane
> (why pass in bprm at all?) but comes from the fact that we used to
> call bprm_secureexec() in an insane place.
>
> So I think this patch series is sadly broken - I think it does the
> right thing, but the security modules definitely look like they need
> to be updated for that right thing.

Yeah, I'll rev this once SELinux is more clear...

-Kees

--
Kees Cook
Pixel Security

\
 
 \ /
  Last update: 2017-07-08 00:11    [W:0.093 / U:0.800 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site