Date: Mon, 1 Oct 2012 14:08:05 +0300 From: Konstantin Belousov <kostikbel@gmail.com> To: Erik Cederstrand <erik@cederstrand.dk> Cc: "freebsd-security@freebsd.org" <freebsd-security@freebsd.org> Subject: Re: Opinion on checking return value of setuid(getuid())? Message-ID: <20121001110805.GL35915@deviant.kiev.zoral.com.ua> In-Reply-To: <F81C009D-F993-4398-B377-D0B4A0ABA7E3@cederstrand.dk> References: <9DD86238-51C8-4F38-B7EB-BD773039888B@cederstrand.dk> <20121001104901.GJ35915@deviant.kiev.zoral.com.ua> <F81C009D-F993-4398-B377-D0B4A0ABA7E3@cederstrand.dk>
next in thread | previous in thread | raw e-mail | index | archive | help
--QV9egoCq9O4JbpTr Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Mon, Oct 01, 2012 at 12:58:41PM +0200, Erik Cederstrand wrote: > Den 01/10/2012 kl. 12.49 skrev Konstantin Belousov <kostikbel@gmail.com>: >=20 > > setuid() might also fail for other reasons, e.g. due to custom MAC modu= le. > >=20 > > In case of ping, does the failure of dropping the suid bit is important= ? >=20 > I believe it is. If 'setuid()' fails then 'uid' becomes 0 and it's possib= le e.g. to do a "Flood ping". I do not believe in the dreadful 'flood ping' security breach. Is a local escalation possible with non-dropped root ? --QV9egoCq9O4JbpTr Content-Type: application/pgp-signature -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (FreeBSD) iEYEARECAAYFAlBpeZUACgkQC3+MBN1Mb4hVSQCgu6dNZmRa5xxou9vCCW70YSAd aKkAn1ACh2+aeVhYCWrK+epJyFeOQ/GA =9om6 -----END PGP SIGNATURE----- --QV9egoCq9O4JbpTr--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20121001110805.GL35915>