False Boundaries and Arbitrary Code Execution

Sun, 02 Jan 2011 00:00:00 -0500

This often-cited post provides a detailed reference to the Linux capability system, subjecting it to critical analysis through the lens of ambient authority, with the revelation that most capabilities are equivalent to full root access if an attacker has arbitrary ability to exercise the capability. It finishes with a discussion on how this plays into PaX's design and grsecurity's RBAC system.