6 ms·
An obscure kernel feature to get more info about dying processes
- JoeAltmaier 16y agoHook root when a process crashes? How long until an exploit?
- deleted 16y ago[deleted]
- InclinedPlane 16y agoIf you have the ability to modify or create files in /proc you almost certainly already control the system.
- dododo 16y agoon the other hand, it makes for an interesting rootkit hook.
- FooBarWidget 16y agoWhich is more dangerous than all the others things you can do as root - like inserting an arbitrary kernel module - how?
- milkshakes 16y agoit's not (yet) an obvious place to look.
- InclinedPlane 16y agoDangerous: no, but he said interesting, so perhaps. The advantage of using little known features, for rootkits, is that people are less likely to look for them.
- dododo 16y agoi never said more dangerous nor intended it. it's not a very good rootkit by itself, certainly, as typically rootkits will monkey with the kernel to hide processes and network sockets. it's interesting because it's probably the simplest rootkit method i can think of (next to setuid binaries). it's less obvious than a setuid. it's not something that anyone sane would use by itself because like i said--it doesn't hide you.
- JoeAltmaier 16y agoYou only need to modify the tool that runs as the hook script...which may or may not be protected
- mmastrac 16y agoNot necessarily. You can trick someone who does have access to write /proc into writing something to /proc for you via symlink or another method. Disclosure: I work on the unrEVOked rooting tool for android and we do stuff like this all the time.
- deleted 16y ago[deleted]
- deleted 16y ago[deleted]
- deleted 16y ago[deleted]
- moonpolysoft 16y agoWhy you mad tho?
- deleted 16y ago[deleted]
- moonpolysoft 16y agohttp://bit.ly/9Q3qTE http://bit.ly/9Q3qTE
- gruseom 16y agoI read it as simply that he was excited about something cool he found. And it is cool. Perhaps you already knew about it; I didn't. Either way, there's no need to be an asshole. ("This plebe"? That's crossing the A-line.)
- deleted 16y ago[deleted]
- kscaldef 16y agoI don't feel like this is a particularly fair criticism of this post. First, this guy is rooting around in the kernel code for fun. Why are we criticizing this? Second, I've done a fair amount of C programming and mucking about at the OS level, and I wasn't aware of this feature. Maybe that's because most of my production deployment has been on BSD and Solaris, not Linux, but I found the post useful. Third, I didn't feel like the author was particularly tooting his own horn, just saying "Hey I found about about this cool thing; maybe you will find this useful too".
- argvzero 16y agou mad!
- barrkel 16y agoIt is nice to know that Linux has this feature, but it essentially amounts to a JIT debugger, and has been in other OSes for a long time. In Windows, it's been there since at least NT 4.
- Marticus 16y agoThis is actually quite interesting - I didn't know you could do that, and I will likely employ it in the future, especially with a remote web server or something you can't immediately get to. So as you roll in, you check your email on your phone, and know walking in what you're getting into and likely how to fix it. From a time-optimization viewpoint, this is nigh-invaluable. Plus this guy has some other very nifty articles. But I guess (glancing at first few comments) that "haterz gonna hate."
- gxti 16y agoFedora's Automated Bug Reporting Tool (abrt) uses this to automatically produce crash reports, which you can sanitize and approve to post in a central location for developers. I imagine that Ubuntu does something similar.
- tzs 16y agoSo what happens if the helper application crashes and tries to dump core? Would it try to run another instance of it to handle that crash, and so on, leading to a "core bomb"?