[lkml]   [2009]   [Dec]   [28]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    SubjectRe: RFC: disablenetwork facility. (v4)
    > Granted - but "is it embedded in code anywhere" is different from "does
    > anybody use such a policy".

    OK, that's fine. But "is it embedded in code anywhere" is the
    question that matters to this thread. And not just in code "anywhere",
    but in code in a setuid-root executable that would become vulnerable if
    Michael's scheme is introduced (yet is not already vulnerable today).

    To refresh: the original context was that Pavel objected to Michael's
    disablenetwork scheme on the basis that it could introduce new security
    vulnerabilities, if some setuid-root program somewhere is written to
    enforce a specific policy. So, to my way of thinking, the only reason to
    spend any energy on this question at all is to determine whether Pavel's
    objection is persuasive. I'm arguing the objection is not persuasive.
    And I'm suggesting that we focus on the question that matters, rather
    than getting distracted by imprecise phrasing Michael may have used when
    he asked the question.

    (Sorry for the misattribution, by the way; I attempted to clean up
    the quoting and made it worse! Sorry.)

    > Out of curiosity, any of the other security types here ever included "getting
    > the damned semi-clued auditor who insists on cargo-cult checklists out of your
    > office" as part of your threat model? Only a half-smiley on this one...

    Sure. :-) One big catch-phrase that covers a lot of this ground is
    'compliance'. Recently there seems to be considerable discussion
    among security professionals about the tension between 'compliance' and
    'security', and whether increased attention to 'compliance' benefits
    'security' or is in the end a distraction.

     \ /
      Last update: 2009-12-29 01:45    [W:0.021 / U:2.884 seconds]
    ©2003-2017 Jasper Spaans. hosted at Digital OceanAdvertise on this site