Date: Mon, 03 Jan 2005 02:37:02 +0300 From: Rojer <myself@rojer.pp.ru> To: freebsd-hackers@freebsd.org Subject: Determining userland return address (from syscall) Message-ID: <41D8859E.4080609@rojer.pp.ru>
next in thread | raw e-mail | index | archive | help
[-- Attachment #1 --]
Greetings, much respected FreeBAS Hackers! :)
I am developing a kernel module that implements a custom syscall and
needs to know from what exact userland address was the call made.
Being concerned about choosing the most correct approach, I turned to
this list for help.
Please provide as much information as you can.
For those interested I will explain the purpose.
I've been thinking of some way to let Apache children a limited ability
to setuid() as a solution for both suexec and the infamous
PHP-as-a-module issue.
The solution I am about to implement is based on a custom setuid
syscall, that would allow limited list of processes to obtain root
privileges from a limited set of locations (supposedly, the trusted
ones, originating in the httpd's .text section).
The modified Apache child would issue such a syscall, get root
privileges and then immediately setusercontext() for the request it is
about to process.
The list of processes and locations would be maintained by Apache parent
that runs with root privileges already, child processes would not be
allowed to modify the list.
The key point here is ability to trust a call being made from a specific
location. I assume that process cannot change its .text section once
loaded so this scheme would no be abused by overwriting the location
with malicious code. Am I correct here? What do you think of this scheme
overall?
Thank you.
--
Deomid Ryabkov aka Rojer
myself@rojer.pp.ru
rojer@sysadmins.ru
ICQ: 8025844
[-- Attachment #2 --]
0 *H
01 0 + 0 *H
#00U
v0
*H
0b1 0 UZA1%0#U
Thawte Consulting (Pty) Ltd.1,0*U#Thawte Personal Freemail Issuing CA0
040331221809Z
050331221809Z0_10URyabkov10
U*Deomid10UDeomid Ryabkov1!0 *H
myself@rojer.pp.ru0"0
*H
0
x?ed:4y h"0 $F;O 4{ 7kU-)A
{ ;qrk,6s+ZȀ&Qvi)ZRu%0 @<r \=/)NK4풓d|$_&aNq!ڨ 66.ʺ`WPFmd;,H,ؑPd0!J5Sـd PIK3@]42g
\i3 /0-0 U 0myself@rojer.pp.ru0 U 0 0
*H
+ ~ 4YXf
DW?%\;҇B2n
Ϸ|Jճ2++fZ7[m~X㽀c6x*2%^ LnmoUkQ|Z>?X\uɝp/:00U
v0
*H
0b1 0 UZA1%0#U
Thawte Consulting (Pty) Ltd.1,0*U#Thawte Personal Freemail Issuing CA0
040331221809Z
050331221809Z0_10URyabkov10
U*Deomid10UDeomid Ryabkov1!0 *H
myself@rojer.pp.ru0"0
*H
0
x?ed:4y h"0 $F;O 4{ 7kU-)A
{ ;qrk,6s+ZȀ&Qvi)ZRu%0 @<r \=/)NK4풓d|$_&aNq!ڨ 66.ʺ`WPFmd;,H,ؑPd0!J5Sـd PIK3@]42g
\i3 /0-0 U 0myself@rojer.pp.ru0 U 0 0
*H
+ ~ 4YXf
DW?%\;҇B2n
Ϸ|Jճ2++fZ7[m~X㽀c6x*2%^ LnmoUkQ|Z>?X\uɝp/:0?0
0
*H
01 0 UZA10U Western Cape10U Cape Town10U
Thawte Consulting1(0&U Certification Services Division1$0"UThawte Personal Freemail CA1+0) *H
personal-freemail@thawte.com0
030717000000Z
130716235959Z0b1 0 UZA1%0#U
Thawte Consulting (Pty) Ltd.1,0*U#Thawte Personal Freemail Issuing CA00
*H
0 Ħ<UsUNʙZ hup [v :aQP
0cZ,p+Z?qV˯< 6$*+w=+>@dקe*TH<a@ dr` 00U 0 0CU <0:08642http://crl.thawte.com/ThawtePersonalFreemailCA.crl0 U 0)U "0 0 10UPrivateLabel2-1380
*H
HP .
fgCL!6 -6/ P p<ab:~ t%Pb'qW%ݩ9 Oe_N4[5MwV!x!5$ F]_eO1;070i0b1 0 UZA1%0#U
Thawte Consulting (Pty) Ltd.1,0*U#Thawte Personal Freemail Issuing CA
v0 + 0 *H
1 *H
0 *H
1
050102233702Z0# *H
12b*rZ %oF0R *H
1E0C0
*H
0*H
0
*H
@0+0
*H
(0x +71k0i0b1 0 UZA1%0#U
Thawte Consulting (Pty) Ltd.1,0*U#Thawte Personal Freemail Issuing CA
v0z *H
1ki0b1 0 UZA1%0#U
Thawte Consulting (Pty) Ltd.1,0*U#Thawte Personal Freemail Issuing CA
v0
*H
'n l-K$[E iS00s1yC1IA㶤L
l \'{v'_ku}Fc/Ir;!1k
I.`x-Ǒ H.Id&ϛ] h u}2NHNE QD4X B2yF]P)B4}mۛ;8u- B21]NL+3 Тx;bB`ZYyQ04l Ҍ4j
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?41D8859E.4080609>