Messages in this thread | | | Subject | Re: Some thoughts about stable kernel development | From | Valdis.Kletnieks@vt ... | Date | Tue, 11 Nov 2003 03:19:04 -0500 |
| |
On Mon, 10 Nov 2003 08:50:44 GMT, John Bradford <john@grabjohn.com> said:
> cause annoyance to third parties. Given that, I think a file in the > root of the kernel tree, saying something like, "Don't use me on an > internet connected machine unless you know what you're doing" would be > worth considering.
OK.. I'll bite.. :)
What *additional* level of "know what you're doing" is called for, over and above the usual "best practices" we wish all net-connected machines implemented?
Or phrased differently - yes, there's several local-user-gets-root attacks that aren't patched. However, I'm sure that even a tightened down and fully-patched system has several ways to do that without leveraging a kernel bug, so the question becomes "balance the chances that the attacker has an exploit for the kernel bug" against "chance attacker has exploit for set-UID program XYZ".
Or is the assumption that if you understand how "remote execution of arbitrary code as local user" combines with "local user gets root" to form the product "you're screwed", sufficient clue is available?
[unhandled content-type:application/pgp-signature] | |