Hacker News Reader

Comment by MartinMond | Hacker News Reader

> Random PIDs > Eliminates race conditions > Say you have a root daemon that forks then the child drops privileges. If you can beat the child you can inherit root privileges

Can someone explain this? I don't see what this has to do with the randomness of pids.

View on HN

Something like after the parent forks, the child opens a file called "/tmp/log.$$" with its PID in the name as root. If you can guess the PID of the child, you could create a link with that name, pointing at a file of your choice that is owned by root, such as "/etc/passwd". Then, you need to make the child do something predictable to that file, such as ensuring that the user supplied data being logged contains text like "\npwn::0:0::/:/bin/sh\n" giving you a valid password file entry for "pwn" with no password and root privileges.

Predictable file names in tmp is considered a security issue pretty much everywhere (hence mkstemp), so I would guess that's not what they mean.

The best I can find on this is https://books.google.nl/books?id=gqKwaHmXp4YC&pg=PA50&lpg=PA....

Seems an extra layer in defence in depth, making it harder to attack a process between the time it is forked and the time it has dropped privileges by making it harder to find it.

That does seem like a strange example. Random source ports is probably a better example of system wide randomization.

Being the most secure OS, these days, is like being valedictorian of summer school. The reality is as soon as you install a dynamic language behind a webserver all their memory tricks are for not. They are still focusing on exploitation from 2002.

Reply on news.ycombinator.com