lkml.org 
[lkml]   [1999]   [Oct]   [26]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: Sealing the kernel
    ---------  Received message begins Here  ---------

    > From androsyn@atomic-city.dev.powerize.com Tue Oct 26 15:50:54 1999
    > On Tue, 26 Oct 1999, Jesse Pollard wrote:
    >
    > > It would be better (in general) to remove root as a privileged user.
    > > Try
    > > http://www.rsbac.de/rsbac/
    > >
    > > for a possible implementation.
    >
    > What about programs that do things like
    >
    > if(geteuid)
    > {
    > printf("Your not root\n");
    > exit(-1);
    > }
    >
    > That is one of the major problems with going a different model, your going
    > to break a lot of software. Perhaps a necessary breakage at some point.
    > But then again this goes against the whole UNIX ideology that root aka UID
    > 0 is all powerful. I guess if the system needs to be that secure,
    > environmental measures need to be taken, like don't have it on publicly
    > accessable networks, or use secure methods of login access like ssh with
    > RSA authentication.

    Besides - if you aren't root you can't do it. If you ARE root and are
    going to do it, then you gain the additional priveleges first. The test
    just becomes irrelevent. (usually the sequence is: gain "security
    administrator", add "system administrator", and (sometimes) add "bypass
    permissions" before doing the function. (Of course the terms are different
    for each system).

    Doesn't really matter - there are systems without a special purpose root
    now - UNICOS can be configured that way, and I believe trusted Solaris,
    trusted IRIX (if you can get it..) and HP has a version. Root is just the
    account that owns the system files, but doesn't necessarily have the
    ability/capability to change them.

    -------------------------------------------------------------------------
    Jesse I Pollard, II
    Email: pollard@navo.hpc.mil

    Any opinions expressed are solely my own.

    -
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.rutgers.edu
    Please read the FAQ at http://www.tux.org/lkml/

    \
     
     \ /
      Last update: 2005-03-22 13:54    [W:0.022 / U:0.260 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site