Re:Unprivileged Process Injection Techniques in Linux
by charcircuit on Sunday December 31, 2023 @11:34AM
(#38825224)
Why does Bash have permission to ptrace or read other process's memory. This should already be locked down, but I suspect it's not because for some reason a lot of systems do not use LSMs or don't care about security in general.
[ Parent
| on HN ]
Re:Unprivileged Process Injection Techniques in Linux
by khuey on Sunday December 31, 2023 @12:18PM
(#38825598)
The same bash instance is the parent of the process being attacked so it meets the requirements to ptrace at yama/ptrace_scope == 1.
Re:Unprivileged Process Injection Techniques in Linux
by Retr0id on Sunday December 31, 2023 @12:41PM
(#38825845)
In the case of stelf-loader, the bash instance is attacking itself. It's not especially unexpected for a process to be able to modify its own memory.
Re:Unprivileged Process Injection Techniques in Linux
by charcircuit on Sunday December 31, 2023 @06:28PM
(#38828398)
>It's not especially unexpected for a process to be able to modify its own memory.
It is unexpected for Bash to do that so it shouldn't be given access to ptrace.
Re:Unprivileged Process Injection Techniques in Linux
by Retr0id on Sunday December 31, 2023 @06:55PM
(#38828533)
stelf-loader does not use ptrace
Re:Unprivileged Process Injection Techniques in Linux
by charcircuit on Sunday December 31, 2023 @07:38PM
(#38828740)
Writing to /proc/pid/mem requires access to ptrace. I never said it would use ptrace directly.
Re:Unprivileged Process Injection Techniques in Linux
by Retr0id on Monday January 01, 2024 @06:29AM
(#38831136)
It's gated by the same access control logic that governs ptrace yes, but it does not use ptrace directly nor indirectly. The first step of that logic is:
> If the calling thread and the target thread are in the same thread group, access is always allowed.