Re: [RFC] Adding a SECURITY policy for GDB

[Siddhesh Poyarekar <siddhesh@redhat.com>]

On 2023-11-06 14:34, Simon Marchi wrote:
> On 11/6/23 08:26, Andrew Burgess wrote:
>>    In the context of local debugging, any bugs in GDB that result in
>>    crossing of a privilege boundary are considered security bugs.  Some
>>    examples of crossing a privilege boundary include; being able to
>>    execute code as an arbitrarily different user, or accessing resources
>>    (e.g. files, sockets, etc) for which the original user would not
>>    normally have access.
> 
> Do you have examples of this?  It seems like any bug in that category would
> be bugs in the platform / OS, not GDB.  If such a bug is possible to exploit
> with GDB, the user could another program to exploit the same bu

That's basically boilerplate to state that *if* such a thing ever 
happens, it will be considered a security issue.  I don't think there 
are any such opportunities for misuse in gdb at the moment, but never 
say never :)

Thanks,
Sid