Return-Path: owner-linux-doc@vger.rutgers.edu
Received: from kantti.helsinki.fi (root@kantti.Helsinki.FI [128.214.4.16]) by keos.Helsinki.FI (8.6.9/H46) with ESMTP id RAA00586 for <wirzeniu@cs.Helsinki.FI>; Wed, 1 Mar 1995 17:29:02 +0200
Received: from vger.rutgers.edu (vger.rutgers.edu [128.6.190.2]) by kantti.helsinki.fi (8.6.10+Emil1.1/8.6.5) with SMTP id RAA14559 for <wirzeniu@cc.helsinki.fi>; Wed, 1 Mar 1995 17:28:56 +0200
Received: (from daemon@localhost) by vger.rutgers.edu (8.6.10/8.6.9) id IAA18289 for linux-doc-outgoing; Wed, 1 Mar 1995 08:36:22 -0500
Message-Id: <199503011325.IAA24188@diversion.stu.rpi.edu>
To: Elias Levy <elias@power.net>
Cc: linux-doc@vger.rutgers.edu
Subject: Re: proc(5) 
In-reply-to: Your message of "Mon, 27 Feb 1995 13:39:16 PST."
             <Pine.LNX.3.91.950227133511.9600G-100000@touchstone.power.net> 
Date: Wed, 01 Mar 1995 08:25:32 -0500
From: Diversion <jeff@diversion.stu.rpi.edu>
Sender: owner-linux-doc@vger.rutgers.edu
Precedence: bulk
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Content-Length: 1141
Status: RO
X-Status: 

> In any case there is a not in the bottom of the page that states
> "The /proc file system totally destroys the security of your system."
[...]
> As you cant see by looking the the newer proc file systems this is not
> true anymore and should be removed from the man page.

I think there's another hold in the /proc filesystem that is exploitable by
root only - if you are in a chroot-ed process as root and the /proc file
system is mounted somewhere visible to you, then you can cd to /proc/1/root
and get to the real root directory.  

Not sure if this is still possible (but I'd expect it to be).  It probably
falls into the category of 'well, the door is off it's hinges so I guess we
can use it to nail over the window to make it more secure' - that is, if
someone is root, there's probably lots of other ways they can do damage. (I
could be wrong...)

Diversion

--
"I can see 'em                       \\  International Associates
   I can see 'em                      \\  "Anyone, anytime, anywhere"
     Someone wake me when it's over"   \\   jeff@diversion.stu.rpi.edu
                                        \\   rogerj@rpi.edu

