lkml.org 
[lkml]   [1998]   [Jun]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: Secure-linux and standard kernel

On Wed, 24 Jun 1998, Mitchell Blank Jr wrote:

> Andi Kleen wrote:
> > If you want to make this secure you hooks in the startup code to drop priviledges even
> > earlier I think.
>
> Yuk.
>
> The real fix will come in 2.3 when ext2 can interface with the capabilities
> stuff. Until then, this will help things. Coming up with an ugly kludge
> (different startup code, different ld.so, etc) is just a distraction from
> real goals like:
>
> 1. Making sure the startup code and ld.so are bullet-proof. If this isn't
> the case the system isn't going to be secure worth a damn anyway.
> Avoiding the problem for a few binaries by writing an alternate loader
> only results in there being more of this code around to audit.
>
> 2. Working towards the filesystem set-capability stuff as mentioned above.

the point is, we dont even need the filesystem set-capability stuff. By
including this feature in the ELF loading mechanizm somehow, _all_
filesystems (that support setuid root) will benefit from this, not only
ext2fs. Theoretically, we only need a single bit in the inode to indicate
that a binary is trusted. The rest can be done in ELF-land.

btw, is there no room in say elf32_hdr to include 64 bits somehow? This
way we could load the physical capabilities mask in the kernel, before
_any_ user-space code is executed, in load_elf_binary(). (the kernel looks
at this bitmask only when the binary is setuid root). No ld.so
modification needed. Also, this gives us nice security for 2.2 already ...

hm? this is really part of the 'executable' proper, _not_ of the
filesystem. capabilities are inherently associated with binary executable
code. There is no point in allocating capabilities bimask for say a news
spool article file ...

-- mingo


-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu

\
 
 \ /
  Last update: 2005-03-22 13:43    [W:0.325 / U:0.140 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site