summaryrefslogtreecommitdiff
path: root/NOFORK_NOEXEC.lst
diff options
context:
space:
mode:
authorDenys Vlasenko2017-08-07 18:18:09 +0200
committerDenys Vlasenko2017-08-07 18:18:09 +0200
commit248a67fb75a0d2c98f4f9935b7bb9e11382b2c78 (patch)
treeeea88807a0b5d936d158ef7a62dfb051df174e96 /NOFORK_NOEXEC.lst
parent316d38e25883c68e51533029dbab059ae0731de8 (diff)
downloadbusybox-248a67fb75a0d2c98f4f9935b7bb9e11382b2c78.zip
busybox-248a67fb75a0d2c98f4f9935b7bb9e11382b2c78.tar.gz
free,stat: make NOEXEC
pkill/pgrep/pidof uncovered another quirk: what about noexec's _process names_? Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
Diffstat (limited to 'NOFORK_NOEXEC.lst')
-rw-r--r--NOFORK_NOEXEC.lst18
1 files changed, 10 insertions, 8 deletions
diff --git a/NOFORK_NOEXEC.lst b/NOFORK_NOEXEC.lst
index 70f38d8..8ec3bdb 100644
--- a/NOFORK_NOEXEC.lst
+++ b/NOFORK_NOEXEC.lst
@@ -16,6 +16,8 @@ leak categories.
Why can't be NOEXEC:
suid: runs under different uid - must fork+exec
+if it's important that /proc/PID/cmdline and comm are correct.
+ ("pkill sh" killing itself before it kills real "sh" is no fun)
Why shouldn't be NOFORK/NOEXEC:
rare: not started often enough to bother optimizing (example: poweroff)
@@ -131,7 +133,7 @@ flash_unlock - hardware
flashcp - hardware
flock - spawner, changes state (file locks), let's play safe and not be noexec
fold - noexec. runner
-free - nofork candidate(struct globals, needs to close /proc/meminfo fd)
+free - noexec. nofork candidate(struct globals, needs to close /proc/meminfo fd)
freeramdisk - leaks: open+ioctl_or_perror_and_die
fsck - interactive, longterm
fsck.minix - needs ^C
@@ -172,7 +174,7 @@ inotifyd - daemon
insmod - noexec
install - runner
ionice - noexec. spawner
-iostat - runner
+iostat - longterm: "iostat 1" runs indefinitely
ip - noexec candidate
ipaddr - noexec candidate
ipcalc - noexec candidate
@@ -244,7 +246,7 @@ mv - noexec candidate, runner
nameif - noexec. openlog(), leaks: config_open2+ioctl_or_perror_and_die
nbd-client - noexec
nc - runner
-netstat - runner with -c
+netstat - longterm with -c (continuous listing)
nice - noexec. spawner
nl - runner
nmeter - longterm
@@ -257,13 +259,13 @@ partprobe - noexec. leaks: open+ioctl_or_perror_and_die(BLKRRPART)
passwd - suid
paste - noexec. runner
patch - needs ^C
-pgrep - nofork candidate(xregcomp, procps_scan - are they ok?)
-pidof - nofork candidate(uses find_pid_by_name, is that ok?)
+pgrep - must fork+exec to get correct /proc/PID/cmdline and comm field
+pidof - must fork+exec to get correct /proc/PID/cmdline and comm field
ping - suid, longterm
ping6 - suid, longterm
pipe_progress - longterm
pivot_root - NOFORK
-pkill - nofork candidate(xregcomp, procps_scan - are they ok?)
+pkill - must fork+exec to get correct /proc/PID/cmdline and comm field
pmap - noexec candidate, leaks: open+xstrdup
popmaildir - runner
poweroff - rare
@@ -329,7 +331,7 @@ sort - noexec. runner
split - runner
ssl_client - longterm
start-stop-daemon - not noexec: uses bb_common_bufsiz1
-stat - nofork candidate(needs fewer allocs)
+stat - noexec. nofork candidate(needs fewer allocs)
strings - runner
stty - noexec. nofork candidate: has no allocs or opens except xmove_fd(xopen("-F DEVICE"),STDIN). tcsetattr(STDIN) is not a problem: it would work the same across processes sharing this fd
su - suid, spawner
@@ -338,7 +340,7 @@ sum - runner
sv - noexec. needs ^C (uses usleep(420000))
svc - noexec. needs ^C (uses usleep(420000))
svlogd - daemon
-swapoff - rare
+swapoff - longterm: may cause memory pressure, execing is beneficial
swapon - rare
switch_root - spawner, rare, changes state (oh yes), execing may be important to free binary's inode
sync - NOFORK