On 10/15/07, Eduardo Tongson <[EMAIL PROTECTED]> wrote: > > Robert Watson's paper discusses concurrency vulnerabilities. Impact > include policy bypass and audit trail invalidation. A bypass means it > is useless. That pretty much hammered in the last nail on the coffin > for security tools based on system call interposition.
Oh really? The abstract reads "System call interposition allows the kernel security model to be extended. However, when combined with current operating systems, it is open to concurrency vulnerabilities leading to privilege escalation and audit bypass." (Paper at <http://www.usenix.org/events/woot07/tech/full_papers/watson/watson.pdf>) and Neils Provos says <http://www.systrace.org/index.php?/archives/14-Evading-System-Sandbox-Containment.html> "The initial prototype of Systrace as described in the paper avoided this problem by using a look-aside buffer in the kernel. This imposes a slight performance penality but I hope that this obvious solution is going to be included in the OpenBSD and NetBSD kernel soon." How is this the "last nail" at all? -Nick
