Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [day] [month] [year] [list]
Date: Sun, 28 Aug 2011 11:55:10 +0400
From: Vasiliy Kulikov <>
Subject: procps hardening


Our procps utils don't filter control characters:

$ cat a.c 
#include <sys/prctl.h>
#include <unistd.h>
int main(int argc, char *argv[])
{ prctl(PR_SET_NAME, argv[1]); argv[0] = argv[1]; sleep(1000); return 0; }
$ gcc -Wall a.c -o a
$ ./a 'smth
> 1    init'
("smth" \n "1" SP SP SP SP "init")

(another tty)
$ pgrep -l smth
4299 smth
1    init

However, it seems ps filters them:

# ps a | grep smth
 4299 pts/2    S+     0:00 ./a smth?1    init

IMO all procps utils should filter ctrls.


Powered by blists - more mailing lists

Your e-mail address:

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.