[PATCH] Error checking for SETXID (bug 13347)

[Florian Weimer]

On 03/24/2014 07:22 PM, Rich Felker wrote:

> It is a critical security flaw to have multiple tasks
> (threads/processes) running in the same virtual address space with
> different privileges. I have described potential attacks for this
> situation before; I could lookup the references if you care.

I think you are wrong—the kernel does it all the time.  It is okay as 
long as you can control what code you run.

We already support it through setfsuid/setfsgid, which is per-thread, 
not per-process.

-- 
Florian Weimer / Red Hat Product Security Team