Subject: Re: RFC: disablenetwork facility. (v4)

From: [email-masked] (Eric W. Biederman)
Date: Tue, 29 Dec 2009 12:40:55 -0800

Benny Amorsen <[email-masked]> writes:

> Bryan Donlan <[email-masked]> writes:
>
>> I, for one, think it would be best to handle it exactly like the
>> nosuid mount option - that is, pretend the file doesn't have any
>> setuid bits set. There's no reason to deny execution; if the process
>> would otherwise be able to execute it, it can also copy the file to
>> make a non-suid version and execute that instead.
>
> Execute != read. The executable file may contain secrets which must not
> be available to the user running the setuid program. If you fail the
> setuid, the user will be able to ptrace() and then the secret is
> revealed.
>
> It's amazing how many security holes appear from what seems like a very
> simple request.

Do we have a security hole in nosuid mount option?
Can someone write a patch to fix it?

Eric