lkml.org 
[lkml]   [1996]   [Dec]   [17]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: Priviledge Groups



On Tue, 17 Dec 1996 bofh@snoopy.virtual.net.au wrote:
[Paul Flinders wrote:]
> >For those who don't have HP-UX 10 systems handy priviledge
> >groups associate groups (although I'd do it to the granularity
> >of users) access to certain system capabilities.
>
> >HP-UX defines
> > Ability to chown(2) files to some other user
> > Ability to call lockf(2) on files open readonly
> > Ability to lock pages in physical memory
> > Ability to set realtime priorities with rtprio(2)
> > Ability to set realtime priorities with the rtsched() functions
> > Ability to use setuid(2) and setgid(2)
>
> >We could usefully add
> > Ability to bind to sockets <1024
> > Ability to use mknod(2)
> > Ability to create hard links to non-owned files.
>
> >Any others?
>
> Ability to run TCPDUMP and other network disgnostics programs.
> Ability to run ifconfig/route and make changes to interfaces and routes.
> Ability to send commands to init (ie shutdown the machine). Ability to access
> the network in any way (I'd like to create guest accounts without any network
> access).

The POSIX.6 patch, and working group has done something like this, only
fully implemented, AFAIR.

However, I think, the only brokennes in schemes, like this, that most of
these "priviledges" can be used to get access to other parts of the
system. I think it would be wise to put more non-priviledges to be not
accessible without special permissions. I.e. network bind(), or file
write() should be allowed only to special programs, that way we could be
sure that for example apache won't write to any files (well, logging is
another matter.. :), or any user won't come up with a network backdoor
daemon, while ftp/lynx still could work... It's a bit against the UNIX
spirit to not allow everything except which should be done by the
superuser, but I think splitting up the root priviledges (i.e. block
reads, mounting file systems, any file write, use of restricted port
range) is not enough, we should stop anyone doing what we don't want, not
just give parts of the root-ness away... (which, as I said, usually can
be used to get the remaining part of it..)

Janos


\
 
 \ /
  Last update: 2005-03-22 13:37    [W:0.045 / U:0.656 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site