lkml.org 
[lkml]   [1998]   [Apr]   [21]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: [patch 2.1.97] more capabilities support
Date
From
Andrew Morgan <morgan@transmeta.com> said:

[...]

> One of the critical things about the capability model is the movement
> away from having executables spontaneously acquire privilege by simply
> being invoked.

> This is one of the main problems with the historical suid model: a
> program gets all the power when it starts up. There are frequently
> new attacks on programs that exploit such a feature. Passing command
> line arguments that overflow a stack comes to mind...
>
> The capability model is designed to change this. The recommended
> behavior for an executable on a fully capability-aware system is to
> not raise "effective" capabilities on startup. Since, without them, it
> has no immediate power. In order to become powerful, it needs to
> request that one or more of its permitted capabilities be made
> effective, with a system call.

That's absolutely no use. If I can subvert your capability-aware process to
do anything, I can subvert it with _my_ code that grabs the capabilities
later. Messier, a bit harder to do. But exactly the same problem as before.
--
Dr. Horst H. von Brand mailto:vonbrand@inf.utfsm.cl
Departamento de Informatica Fono: +56 32 654431
Universidad Tecnica Federico Santa Maria +56 32 654239
Casilla 110-V, Valparaiso, Chile Fax: +56 32 797513

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu

\
 
 \ /
  Last update: 2005-03-22 13:42    [W:1.647 / U:0.328 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site