Home page logo
/

bugtraq logo Bugtraq mailing list archives

Re: /proc filesystem allows bypassing directory permissions on Linux
From: Pavel Machek <pavel () ucw cz>
Date: Fri, 30 Oct 2009 18:38:33 +0100

Hi!

Your assumption that the same file descriptor is being re-opened is
wrong!
The file descriptor retrieved via /proc is a new one. It is not the
same as the
initial read-only.

True, we were just being sloppy with the words. But it does not matter
one iota.

As Martin Rex already explained yesterday, /proc is all virtual.
The item referred as fd in /proc is not a real file descriptor and as
of that, that 'not-tfor-real file descriptor' is also not re-opend
and so does
not become read-write.

True.

Imagen:
- a house surrounded with a fence with all doors unlocked (file with
perm 0666)
- a drive-way leads to the gate in the fence and the gate is
unlocked (dir with perms 777)
- next we put a lock on the gate and don't give guest the key (dir
with perms 700)
- guest cannot access the house because he can't pass the gate
- now we take an airplane and parachute guest straight into the
perimeter of the fence (/proc access)
- guest can access the house (write the file), because the house has
all doors unlocked

Exactly, and I'm saying that airplanes should not exist (fix the 
/proc).  Martin Rex had another solution -- allow fcntl() to remove
read-only and append-only limitations, so that behaviour is at least
explicit.

                                                                        Pavel
-- 
(english) http://www.livejournal.com/~pavelmachek
(cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]