[lkml]   [2000]   [Feb]   [10]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    SubjectRe: Capabilities
    In message <>, Peter Benie writes:
    | Matthew Kirkwood writes ("Re: Capabilities"):
    | > > Capabilities don't solve the inability to change which port is bound
    | > > since cap_net_bind_service is equivalent to root on most machines.
    | >
    | > Please explain? If bind has only CNBS and runs as user "named",
    | > then there is no root equivalence that I can see.
    | If you can bind to low numbered ports, you can fake credentials for
    | rsh or rlogin. From there, you can get to root on many machines

    I can do that from a Windows PC, if necessary spoofing packets from a
    legitimate host. So?

    Anyone who doesn't disable or severely restrict the r-commands is begging
    for trouble: *they* are the security holes here, not CNBS.

    brandon s. allbery os/2,linux,solaris,perl
    system administrator kthkrb,heimdal,gnome,rt
    carnegie mellon / electrical and computer engineering kf8nh
    We are Linux. Resistance is an indication that you missed the point.

    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to
    Please read the FAQ at

     \ /
      Last update: 2005-03-22 13:56    [W:0.022 / U:5.076 seconds]
    ©2003-2017 Jasper Spaans. hosted at Digital OceanAdvertise on this site