Messages in this thread | | | Date | Sun, 10 Jan 2010 17:46:49 -0800 | From | Casey Schaufler <> | Subject | Re: [PATCH 2/3] Security: Implement disablenetwork semantics. (v4) |
| |
Tetsuo Handa wrote: > Michael Stone wrote: > >> Examples of software that I want to be able to gain privileges normally include: >> >> rainbow, which requires privilege in order to add new accounts to the system >> and in order to call setuid() but which does not require networking >> privileges. >> > > If the system is not using local files (i.e. /etc/passwd and /etc/shadow), > the process who wants to add new accounts to the system might need network > access (e.g. to LDAP server), doesn't it? > >
It's much worse than that. A user that has been network disabled who tries using ls may find that it goes looking for the network on each name lookup and has to wait for a timeout for each. Yet another example of why Real Users hate security features with such passion. Then, if there are local file entries that differ from the "official" network account values when the library functions finally fall back on the local values you get the wrong names for file owners. Now we've made ls slow and untrustworthy in the name of security.
| |