3 ms·

Maybe I'm missing something here, but what stops you from putting a setuid "su" binary and keeping the root access, even if the kernel is upgraded?

• deleted 10y ago
  [deleted]
• therein 10y ago
  You're root running in a limited selinux context.
  • omribahumi 10y ago
    I'm assuming that's because of the Android security model, rather than a limitation of the exploit itself? edit: Apparently SETUID is disabled on Android: ... using kernel features that help block privilege escalation (e.g. NOSUID, NO_NEW_PRIVS). source: https://lwn.net/Articles/609511/ https://lwn.net/Articles/609511/ also: https://unix.stackexchange.com/a/250806/95938 https://unix.stackexchange.com/a/250806/95938
  • daveloyall 10y ago
    Are you saying that on Android, you can achieve UID=0 via this exploit, but still not write to anywhere important on the device? What are these different "methods" listed in the table here? https://github.com/dirtycow/dirtycow.github.io/wiki/PoCs https://github.com/dirtycow/dirtycow.github.io/wiki/PoCs Can one of those methods allow me to write to some file in /etc? (Which is enough to grant me the access I want, unless selinux is just MAGIC.)
    • therein 10y ago
      SELinux can still prevent you (even if you are `$UID=0`) from performing an operation such as writing to a file under `/etc`. You would need to be able to `setenforce 0 `. A properly configured SELinux context can prevent you from doing that however we are starting to finally see some reports of dirtyc0w successfuly leading to `SELinux status: permissive` and permanent root.