Re: libresolv+ bug

[Don.Lewis () tsc tdk com (Don Lewis)]

On Aug 20,  9:25am, Alan Cox wrote:
} Subject: Re: libresolv+ bug
} > Well, if the text segment is read-only, that makes it rather difficult
} > to patch the binary.  But if the binary has privilege to go setuid,
}
} No no no, this is a perpetual fiction item I keep meeting. If its
} not being setuid at the time you can use ptrace() to patch it. You can
} use mprotect to change the protection of the C library image (its COW
} so it doesnt hurt others). Your code space is not some mythical sanctuary.

Ooh, could this be *another* hole?  You carefully write your code to
give up privileges except when they are absolutely needed, but then
Mr. Bad Guy attaches to the process when it's in the unprivileged state and
patches the text to seteuid(0) and exec("/bin/sh").

I sure hope there is no way to attach a process unless it has permanently
renounced privileges.

                        ---  Truck