Re: [PATCH v2 0/2] setgid hardening

2017-01-30 Thread Andy Lutomirski
On Mon, Jan 30, 2017 at 7:49 PM, Michael Kerrisk wrote: > [CC += linux-api@] > > Andy, this is an API change! Indeed. I should be ashamed of myself! > > On Sat, Jan 28, 2017 at 3:49 PM, Andy Lutomirski wrote: >> The kernel has some dangerous behavior involving the creation and >> modification

Re: [PATCH v2 0/2] setgid hardening

2017-01-30 Thread Michael Kerrisk
[CC += linux-api@] Andy, this is an API change! On Sat, Jan 28, 2017 at 3:49 PM, Andy Lutomirski wrote: > The kernel has some dangerous behavior involving the creation and > modification of setgid executables. These issues aren't kernel > security bugs per se, but they have been used to turn va

[PATCH v2 0/2] setgid hardening

2017-01-27 Thread Andy Lutomirski
The kernel has some dangerous behavior involving the creation and modification of setgid executables. These issues aren't kernel security bugs per se, but they have been used to turn various filesystem permission oddities into reliably privilege escalation exploits. See http://www.halfdog.net/Sec