Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [day] [month] [year] [list]
Date: Sun, 28 Aug 2011 11:55:10 +0400
From: Vasiliy Kulikov <segoon@...nwall.com>
To: owl-dev@...ts.openwall.com
Subject: procps hardening

Solar,

Our procps utils don't filter control characters:

$ cat a.c 
#include <sys/prctl.h>
#include <unistd.h>
int main(int argc, char *argv[])
{ prctl(PR_SET_NAME, argv[1]); argv[0] = argv[1]; sleep(1000); return 0; }
$ gcc -Wall a.c -o a
$ ./a 'smth
> 1    init'
("smth" \n "1" SP SP SP SP "init")

(another tty)
$ pgrep -l smth
4299 smth
1    init

However, it seems ps filters them:

# ps a | grep smth
 4299 pts/2    S+     0:00 ./a smth?1    init


IMO all procps utils should filter ctrls.

-- 
Vasiliy

Powered by blists - more mailing lists

Your e-mail address:

Powered by Openwall GNU/*/Linux - Powered by OpenVZ