Messages in this thread | | | Date | Fri, 1 Jan 2010 14:46:29 +0000 | From | Alan Cox <> | Subject | Re: [RFC][PATCH v3] Unprivileged: Disable raising of privileges |
| |
On Thu, 31 Dec 2009 17:55:27 +0000 (UTC) daw@cs.berkeley.edu (David Wagner) wrote:
> Alan Cox wrote: > >Removing specific features from a specific piece of code > >generally isn't a security feature - > > You lost me there. The ability of a specific piece of code to voluntarily > relinquish privileges can be a big benefit to security.
Can be - but its historically been an endless source of bugs and flaws because the code being run after you take the rights away is being run in an environment it didn't expect and wasn't tested in.
From inanities like setting the file size limit to 0 and running passwd blanking the password file (SGI Irix) to closing file handle 0 or setting cpu quotas to make a forked daemon process die unexpectedly the list is endless.
Alan
| |