mirror of
https://github.com/RGBCube/serenity
synced 2025-05-31 11:48:10 +00:00
Kernel: Move select Process members into protected memory
Process member variable like m_euid are very valuable targets for kernel exploits and until now they have been writable at all times. This patch moves m_euid along with a whole bunch of other members into a new Process::ProtectedData struct. This struct is remapped as read-only memory whenever we don't need to write to it. This means that a kernel write primitive is no longer enough to overwrite a process's effective UID, you must first unprotect the protected data where the UID is stored. :^)
This commit is contained in:
parent
839d2d70a4
commit
cbcf891040
12 changed files with 190 additions and 130 deletions
|
@ -40,7 +40,7 @@ KResultOr<int> Process::sys$pipe(int pipefd[2], int flags)
|
|||
return EINVAL;
|
||||
|
||||
u32 fd_flags = (flags & O_CLOEXEC) ? FD_CLOEXEC : 0;
|
||||
auto fifo = FIFO::create(m_uid);
|
||||
auto fifo = FIFO::create(uid());
|
||||
|
||||
auto open_reader_result = fifo->open_direction(FIFO::Direction::Reader);
|
||||
if (open_reader_result.is_error())
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue