Date: Tue, 01 Jan 2019 12:27:07 +0100 From: nisse@...ator.liu.se (Niels Möller) To: Matthew Fernandez <matthew.fernandez@...il.com> Cc: oss-security@...ts.openwall.com, Jeffrey Walton <noloader@...il.com> Subject: Disabling ptrace (was Re: Asserts considered harmful (or GMP spills its sensitive information)) Matthew Fernandez <matthew.fernandez@...il.com> writes: > E.g. you can attach > to the victim process with gdb/ptrace and simply read its memory, if > the sysadmin has not blocked this with Yama or similar. I think one can disable this in the process itself, using prctl with PR_SET_DUMPABLE. But documentation is a bit unclear and doesn't exlicitly mention effect on ptrace (and other debugging interfaces). If there are any documented best practices, that would be very nice. My main usecase is lshd (an ssh daemon), which spawns a helper process with uid of the logged in user, but with gid set to the utmp group, to provide restricted write access to the utmp database. This is spawned by a process running as root, so no setuid or setgid executables involved. Attaching to that process with gdb may imply privilege escalation to compromise utmp. Last time I tried to investigate, including reading some linux kernel sources, PR_SET_DUMPABLE looked promising. (Note I'm not subscribed to the oss-security list, and I'm dropping the gmp-bugs list where this is off-topic. So please include my email in any replies). Regards, /Niels -- Niels Möller. PGP-encrypted email is preferred. Keyid 368C6677. Internet email is subject to wholesale government surveillance.
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.