Messages in this thread | | | From | (David Wagner) | Subject | Re: [PATCH 2.6.18 try 2] net/ipv4: sysctl to allow non-superuser to bypass CAP_NET_BIND_SERVICE requirement | Date | Fri, 22 Sep 2006 09:37:04 +0000 (UTC) |
| |
William Pitcock wrote: >Additionally, with your solution, the program would still need to be >extensively modified.
I suspect "extensively" may be a little bit of an overstatement, though it sure would take some doing. With some work, it may be possible to write an alternative implementation of bind() that creates a Unix domain socket, forks, execs a copy of the setuid-root program, recieves a copy of the newly opened fd passed over the Unix domain socket, and returns that to the caller of bind(). In this way, it might be possible to build a solution that requires only minimal modifications to the app (just change how it is linked). It'd be messy and thoroughly unportable (because it would only work on systems where that setuid program was installed), but maybe doable.
>However, that's really not a bad idea (what you proposed). But, I >still believe that the sysctl patch is more flexible, especially in >cases where you might not have the source-code to what you are trying >to run (common with enterprise apps, gameserver admin panels, etc.).
Ok. Understandable. I leave it to others to comment further. I'm not advocating anything either way. - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |