> > This is scary. But I believe it is safe. > > > > Reviewed-by: Serge Hallyn <serge@xxxxxxxxxx> > > > > I am a bit curious about the implications of the selinux patch. > > IIUC you are using the permission of the tracing process to execute > > the file without transition, so this is a way to work around the > > policy which might prevent the tracee from doing so. > > Given that SELinux wants to be MAC, I'm not *quite* sure that's > > considered kosher. You also are skipping the PROCESS__PTRACE to > > SECCLASS_PROCESS check which selinux_bprm_set_creds does later on. > > Again I'm just not quite sure what's considered normal there these > > days. > > > > Paul, do you have input there? > > I agree, the SELinux hook looks wrong. Building on what Christian said, this looks more like a ptrace operation than an exec operation. Serge, Paul, Christian, I made a PoC to demonstrate the change of /proc/self/exe without CAP_SYS_ADMIN using only ptrace and execve. You may find it here: https://github.com/nviennot/run_as_exe What do you recommend to relax the security checks in the kernel when it comes to changing the exe link? Nico
