Re: Opinion on checking return value of setuid(getuid())?

--QV9egoCq9O4JbpTr
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Mon, Oct 01, 2012 at 12:58:41PM +0200, Erik Cederstrand wrote:
> Den 01/10/2012 kl. 12.49 skrev Konstantin Belousov <[e-mail]>:
>=20
> > setuid() might also fail for other reasons, e.g. due to custom MAC modu=
le.
> >=20
> > In case of ping, does the failure of dropping the suid bit is important=
 ?
>=20
> I believe it is. If 'setuid()' fails then 'uid' becomes 0 and it's possib=
le e.g. to do a "Flood ping".

I do not believe in the dreadful 'flood ping' security breach. Is a
local escalation possible with non-dropped root ?

--QV9egoCq9O4JbpTr
Content-Type: application/pgp-signature

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (FreeBSD)

iEYEARECAAYFAlBpeZUACgkQC3+MBN1Mb4hVSQCgu6dNZmRa5xxou9vCCW70YSAd
aKkAn1ACh2+aeVhYCWrK+epJyFeOQ/GA
=9om6
-----END PGP SIGNATURE-----

--QV9egoCq9O4JbpTr--