On Mon, Oct 01, 2012 at 12:58:41PM +0200, Erik Cederstrand wrote: > Den 01/10/2012 kl. 12.49 skrev Konstantin Belousov <[email protected]>: > > > setuid() might also fail for other reasons, e.g. due to custom MAC module. > > > > In case of ping, does the failure of dropping the suid bit is important ? > > I believe it is. If 'setuid()' fails then 'uid' becomes 0 and it's possible > e.g. to do a "Flood ping".
I do not believe in the dreadful 'flood ping' security breach. Is a local escalation possible with non-dropped root ?
pgp1c7ftJZqxa.pgp
Description: PGP signature
