Shallow argument inspection for execve
Shallow argument inspection for execve
Posted Sep 19, 2019 19:56 UTC (Thu) by jreiser (subscriber, #11027)Parent article: Deep argument inspection for seccomp
It would even be handy if argv[k] could be readily inspected during the LSM processing for execve. Today this is possible but cumbersome using tomoyo_security. Instead, remove_arg_zero() in fs/exec.c could return into a buffer what it removed. The entire argv[] could be restored by remembering and resetting the original string pointer and count before any calls to remove_arg_zero().