lkml.org 
[lkml]   [1998]   [Apr]   [21]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
SubjectRe: [patch 2.1.97] more capabilities support
Date
>> The real problem here is that it is hard to defend against poorly
>> written code that requires privilege. The benefit from capabilities
>> over the setuid case is that you can limit the damage...
>
> Actually, it's very easy. Just don't give it more authority than it
> needs. If you give the program only one direction where it can shoot at,
> it doesn't matter that much anymore if the code is right or wrong from
> the security perspective, because the program can't shoot anywhere else
> than in that one direction anyway. The only thing that it can do then is
> shoot a faulty bullet that won't reach the target (or will blow up the
> gun, killing the shooter, which is a good thing because it will point
> out the bug so that it can be fixed).

I believe we were discussing POSIX capabilities, not pure capabilities.

I'll mail you about the pure capabilities later, but it appears that
they are fairly useless outside of an environment like EROS:
persistent system image, long-lived processes, NO FILESYSTEM, and
every scrap of data is an object associated with some code.

That persistent system image is nice for hardware failures,
but it means you get to repeat software crashes at every reboot!
Removal of the persistent system image is a reinstall.

I hope everyone has seen this by now:
http://agn-www.informatik.uni-hamburg.de/people/1ott/rsbac/index.htm

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu

\
 
 \ /
  Last update: 2005-03-22 13:42    [W:1.206 / U:0.380 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site