kernel-hardening - rlimit

Date: Thu, 9 Jun 2011 18:17:45 +0400
From: Vasiliy Kulikov <segoon@...nwall.com>
To: kernel-hardening@...ts.openwall.com
Subject: rlimit_nproc check

Solar, all -

I found 8-years old patch that enables RLIMIT_NPROC check at setuid (and
similar) calls:

http://lkml.org/lkml/2003/7/13/226

So, checking it on execve() is a bit redundant.  But it means that
setuid() may fail if it follows setrlimit() call and the target user
has already reached the limit (asserted on the test C program).  If the
limit is defined in pam_limit, the attack becomes real.

Thanks,

-- 
Vasiliy

Download attachment "signature.asc" of type "application/pgp-signature" (837 bytes)

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.