From owner-freebsd-current Thu Sep 7 15: 0:22 2000 Delivered-To: freebsd-current@freebsd.org Received: from mail2.netcologne.de (mail2.netcologne.de [194.8.194.103]) by hub.freebsd.org (Postfix) with ESMTP id 6645837B42C for ; Thu, 7 Sep 2000 15:00:17 -0700 (PDT) Received: from bagabeedaboo.security.at12.de (dial-213-168-64-238.netcologne.de [213.168.64.238]) by mail2.netcologne.de (8.9.3/8.9.3) with ESMTP id AAA20060; Fri, 8 Sep 2000 00:00:05 +0200 (MET DST) Received: from localhost (localhost.security.at12.de [127.0.0.1]) by bagabeedaboo.security.at12.de (8.11.0/8.11.0) with ESMTP id e87Lxr900419; Thu, 7 Sep 2000 23:59:53 +0200 (CEST) (envelope-from pherman@frenchfries.net) Date: Thu, 7 Sep 2000 23:59:52 +0200 (CEST) From: Paul Herman To: "Zach N. Heilig" Cc: freebsd-current@FreeBSD.ORG, Vivek Khera Subject: Re: call for testers: init securelevel patch In-Reply-To: <20000907152923.A57609@murkwood.znh.org> Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-freebsd-current@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.ORG On Thu, 7 Sep 2000, Zach N. Heilig wrote: > On Thu, Sep 07, 2000 at 06:33:20PM +0200, Paul Herman wrote: > > > Here is a patch which will allow init(8) (or rather, any process with > > PID 1) to lower the securelevel to 0 when going into single-user > > maintenence mode. This has no effect if securelevel is -1. > > This was the behavior a while back. It was removed on purpose. (because > an attacker could attach to PID 1 with a debugger and cause it to lower > secure level without going to single user mode.) You can't trace PID 1 when securelevel > 0. /src/sys/kern/subr_process.c So I think it's still safe... -Paul. To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-current" in the body of the message