From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752077Ab2DMEfL (ORCPT ); Fri, 13 Apr 2012 00:35:11 -0400 Received: from tundra.namei.org ([65.99.196.166]:53493 "EHLO tundra.namei.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751109Ab2DMEfH (ORCPT ); Fri, 13 Apr 2012 00:35:07 -0400 Date: Fri, 13 Apr 2012 14:34:00 +1000 (EST) From: James Morris To: Andrew Lutomirski cc: Will Drewry , linux-kernel@vger.kernel.org, linux-man@vger.kernel.org, linux-security-module@vger.kernel.org, linux-arch@vger.kernel.org, linux-doc@vger.kernel.org, kernel-hardening@lists.openwall.com, netdev@vger.kernel.org, x86@kernel.org, arnd@arndb.de, "David S. Miller" , hpa@zytor.com, mingo@redhat.com, Oleg Nesterov , peterz@infradead.org, rdunlap@xenotime.net, mcgrathr@chromium.org, tglx@linutronix.de, Eric Paris , Serge Hallyn , djm@mindrot.org, scarybeasts@gmail.com, indan@nul.nu, pmoore@redhat.com, Andrew Morton , Jonathan Corbet , eric.dumazet@gmail.com, markus@chromium.org, coreyb@linux.vnet.ibm.com, Kees Cook , Andy Lutomirski , Stephen Smalley Subject: Re: [PATCH v18 01/15] Add PR_{GET,SET}_NO_NEW_PRIVS to prevent execve from granting privs In-Reply-To: Message-ID: References: <1334267284-19166-1-git-send-email-wad@chromium.org> User-Agent: Alpine 2.02 (LRH 1266 2009-07-14) MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Thu, 12 Apr 2012, Andrew Lutomirski wrote: > > What about dynamic transitions in SELinux ? > > > > What's a dynamic transition? The security label can be changed without an exec: See selinux_setprocattr(), for "current". - James -- James Morris From mboxrd@z Thu Jan 1 00:00:00 1970 From: James Morris Subject: Re: [PATCH v18 01/15] Add PR_{GET,SET}_NO_NEW_PRIVS to prevent execve from granting privs Date: Fri, 13 Apr 2012 14:34:00 +1000 (EST) Message-ID: References: <1334267284-19166-1-git-send-email-wad@chromium.org> Reply-To: kernel-hardening@lists.openwall.com Mime-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Cc: Will Drewry , linux-kernel@vger.kernel.org, linux-man@vger.kernel.org, linux-security-module@vger.kernel.org, linux-arch@vger.kernel.org, linux-doc@vger.kernel.org, kernel-hardening@lists.openwall.com, netdev@vger.kernel.org, x86@kernel.org, arnd@arndb.de, "David S. Miller" , hpa@zytor.com, mingo@redhat.com, Oleg Nesterov , peterz@infradead.org, rdunlap@xenotime.net, mcgrathr@chromium.org, tglx@linutronix.de, Eric Paris , Serge Hallyn , djm@mindrot.org, scarybeasts@gmail.com, indan@nul.nu, pmoore@redhat.com, Andrew Morton , Jonathan Corbet , eric.dumazet@gmail.com, markus@chromium.org, coreyb@linux.vnet.ibm.com, Kees Cook Return-path: List-Post: List-Help: List-Unsubscribe: List-Subscribe: In-Reply-To: List-Id: netdev.vger.kernel.org On Thu, 12 Apr 2012, Andrew Lutomirski wrote: > > What about dynamic transitions in SELinux ? > > > > What's a dynamic transition? The security label can be changed without an exec: See selinux_setprocattr(), for "current". - James -- James Morris From mboxrd@z Thu Jan 1 00:00:00 1970 From: James Morris Subject: Re: [PATCH v18 01/15] Add PR_{GET,SET}_NO_NEW_PRIVS to prevent execve from granting privs Date: Fri, 13 Apr 2012 14:34:00 +1000 (EST) Message-ID: References: <1334267284-19166-1-git-send-email-wad@chromium.org> Reply-To: kernel-hardening@lists.openwall.com Mime-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Return-path: List-Post: List-Help: List-Unsubscribe: List-Subscribe: In-Reply-To: To: Andrew Lutomirski Cc: Will Drewry , linux-kernel@vger.kernel.org, linux-man@vger.kernel.org, linux-security-module@vger.kernel.org, linux-arch@vger.kernel.org, linux-doc@vger.kernel.org, kernel-hardening@lists.openwall.com, netdev@vger.kernel.org, x86@kernel.org, arnd@arndb.de, "David S. Miller" , hpa@zytor.com, mingo@redhat.com, Oleg Nesterov , peterz@infradead.org, rdunlap@xenotime.net, mcgrathr@chromium.org, tglx@linutronix.de, Eric Paris , Serge Hallyn , djm@mindrot.org, scarybeasts@gmail.com, indan@nul.nu, pmoore@redhat.com, Andrew Morton , Jonathan Corbet , eric.dumazet@gmail.com, markus@chromium.org, coreyb@linux.vnet.ibm.com, Kees Cook List-Id: linux-man@vger.kernel.org On Thu, 12 Apr 2012, Andrew Lutomirski wrote: > > What about dynamic transitions in SELinux ? > > > > What's a dynamic transition? The security label can be changed without an exec: See selinux_setprocattr(), for "current". - James -- James Morris From mboxrd@z Thu Jan 1 00:00:00 1970 Reply-To: kernel-hardening@lists.openwall.com Date: Fri, 13 Apr 2012 14:34:00 +1000 (EST) From: James Morris In-Reply-To: Message-ID: References: <1334267284-19166-1-git-send-email-wad@chromium.org> MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Subject: [kernel-hardening] Re: [PATCH v18 01/15] Add PR_{GET,SET}_NO_NEW_PRIVS to prevent execve from granting privs To: Andrew Lutomirski Cc: Will Drewry , linux-kernel@vger.kernel.org, linux-man@vger.kernel.org, linux-security-module@vger.kernel.org, linux-arch@vger.kernel.org, linux-doc@vger.kernel.org, kernel-hardening@lists.openwall.com, netdev@vger.kernel.org, x86@kernel.org, arnd@arndb.de, "David S. Miller" , hpa@zytor.com, mingo@redhat.com, Oleg Nesterov , peterz@infradead.org, rdunlap@xenotime.net, mcgrathr@chromium.org, tglx@linutronix.de, Eric Paris , Serge Hallyn , djm@mindrot.org, scarybeasts@gmail.com, indan@nul.nu, pmoore@redhat.com, Andrew Morton , Jonathan Corbet , eric.dumazet@gmail.com, markus@chromium.org, coreyb@linux.vnet.ibm.com, Kees Cook , Andy Lutomirski , Stephen Smalley List-ID: On Thu, 12 Apr 2012, Andrew Lutomirski wrote: > > What about dynamic transitions in SELinux ? > > > > What's a dynamic transition? The security label can be changed without an exec: See selinux_setprocattr(), for "current". - James -- James Morris