> * Stephen Smalley (
sds@tycho.nsa.gov) wrote:
> > On Wed, 2008-05-14 at 02:15 -0700, Chris Wright wrote:
> > > It is slightly ad-hoc. Is it just the audit messages that you described
> > > that made you pick environ and fd, or was there more specific (threat
> > > based) reasoning? Would /proc/pid/fd/ + genfs + e.g. anonfd be a little
> > > wider than just readstate?
> >
> > Well, it is being driven by experience with what applications try to
> > access w/o requiring full ptrace access, but also by a threat-based
> > reasoning that it is less dangerous to grant limited read access to
> > parts of the process state than to grant complete read access to its
> > entire memory image or full control of the target process.
> >
> > Not entirely sure what you mean by the latter question.
>
> fd/ access gives a view in the ->files, which could include rather
> internal bits like pipes, sockets, or anonfd descriptors -- things w/out
> external handles. That view includes ability to open the fd (similar
> to dup()) and use it (granted subject to further security checks, but
> they may be quite generic at that point).
