[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 01 Jan 2019 12:27:07 +0100
From: nisse@...ator.liu.se (Niels Möller)
To: Matthew Fernandez <matthew.fernandez@...il.com>
Cc: oss-security@...ts.openwall.com, Jeffrey Walton <noloader@...il.com>
Subject: Disabling ptrace (was Re: Asserts considered harmful (or GMP spills its sensitive information))
Matthew Fernandez <matthew.fernandez@...il.com> writes:
> E.g. you can attach
> to the victim process with gdb/ptrace and simply read its memory, if
> the sysadmin has not blocked this with Yama or similar.
I think one can disable this in the process itself, using prctl with
PR_SET_DUMPABLE. But documentation is a bit unclear and doesn't
exlicitly mention effect on ptrace (and other debugging interfaces).
If there are any documented best practices, that would be very nice.
My main usecase is lshd (an ssh daemon), which spawns a helper process
with uid of the logged in user, but with gid set to the utmp group, to
provide restricted write access to the utmp database. This is spawned by
a process running as root, so no setuid or setgid executables involved.
Attaching to that process with gdb may imply privilege escalation to
compromise utmp. Last time I tried to investigate, including reading
some linux kernel sources, PR_SET_DUMPABLE looked promising.
(Note I'm not subscribed to the oss-security list, and I'm dropping the
gmp-bugs list where this is off-topic. So please include my email in any
replies).
Regards,
/Niels
--
Niels Möller. PGP-encrypted email is preferred. Keyid 368C6677.
Internet email is subject to wholesale government surveillance.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
