On 10/14/07, Steve Shockley <[EMAIL PROTECTED]> wrote: > The white paper for the systrace vulnerability was a little bit beyond > me; what's the impact of the issue? Is a system running systrace *more* > vulnerable than a normal system, or is the problem just that a > determined user can circumvent systrace (like the bottom of systrace(1) > suggests)? If it's the latter, it seems like it'd still be useful for > policy enforcement to some extent.
two processes using shared memory can cooperate to circumvent systrace. this means it's not very useful to contain an app after exploitation. also, circumvention is not "silent". if you log failures, you'll see it happening. systrace is still useful for keeping an eye on binary programs. or to make sure your apps are configured correctly (web server can't read files outside of blah/, whatever).
