Jack Lloyd wrote:
On Thu, Mar 06, 2008 at 07:13:20PM +0100, Paolo Bonzini wrote:A process can send a signal via kill. IOW, a malicious process can *control when the process would be interrupted* in order to get it into the signal handler with DF=1.If the malicious process can send a signal to another process, it could also ptrace() it. Which is more useful, if you wanted to be malicious?
1) capabilities(7) 2) sometimes setuid programs send signals (e.g. SIGHUP or SIGUSR1)... Paolo
