Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1580028
| From | Kees Cook <keescook@chromium.org> |
|---|---|
| Newsgroups | linux.kernel |
| Subject | Re: [PATCH v4 2/2] procfs/tasks: add a simple per-task procfs hidepid= field |
| Date | 2017-02-13 20:20 +0100 |
| Message-ID | <taukh-7S8-1@gated-at.bofh.it> (permalink) |
| References | (3 earlier) <t17mV-1Gi-5@gated-at.bofh.it> <t17mV-1Gi-1@gated-at.bofh.it> <t17ZE-2aa-19@gated-at.bofh.it> <t9t6W-1Dv-1@gated-at.bofh.it> <tauaC-7Oj-7@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
On Mon, Feb 13, 2017 at 11:01 AM, Andy Lutomirski <luto@amacapital.net> wrote: > On Fri, Feb 10, 2017 at 3:44 PM, Kees Cook <keescook@chromium.org> wrote: >> On Wed, Jan 18, 2017 at 3:35 PM, Andy Lutomirski <luto@amacapital.net> wrote: >>> On Wed, Jan 18, 2017 at 2:50 PM, Djalal Harouni <tixxdz@gmail.com> wrote: >>>> Andy I don't follow here, no_new_privs is never cleared right ? I >>>> can't see the corresponding clear bit code for it. >>> >>> I believe that unsharing userns clears no_new_privs. >> >> Seriously? That's kind of ... weird. I mean, I guess you're >> priv-confined in a way, but that seems fragile. >> > > I appear to have made this up. Either I genuinely pulled it out of > thin air or it was discussed and not done. > > $ setpriv --nnp unshare -Ur cat /proc/self/status |grep NoNewPrivs > NoNewPrivs: 1 > > If it were to be done, it ought to be quite safe except for possible LSM issues. Okay, cool. Thanks. (Also, where does "setpriv" live? I must need a new set of util-linux or something?) -Kees -- Kees Cook Pixel Security
Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
Re: [PATCH v4 2/2] procfs/tasks: add a simple per-task procfs hidepid= field Kees Cook <keescook@chromium.org> - 2017-02-11 00:50 +0100
Re: [PATCH v4 2/2] procfs/tasks: add a simple per-task procfs hidepid= field Andy Lutomirski <luto@amacapital.net> - 2017-02-13 20:10 +0100
Re: [PATCH v4 2/2] procfs/tasks: add a simple per-task procfs hidepid= field Kees Cook <keescook@chromium.org> - 2017-02-13 20:20 +0100
Re: [PATCH v4 2/2] procfs/tasks: add a simple per-task procfs hidepid= field Christian Kujau <lists@nerdbynature.de> - 2017-02-14 05:20 +0100
csiph-web