Messages in this thread | | | Date | Tue, 21 Apr 1998 22:52:59 -0700 | From | Andrew Morgan <> | Subject | Re: [patch 2.1.97] more capabilities support |
| |
> > The capability model is designed to change this. The recommended > > behavior for an executable on a fully capability-aware system is to > > not raise "effective" capabilities on startup. Since, without them, it > > has no immediate power. In order to become powerful, it needs to > > request that one or more of its permitted capabilities be made > > effective, with a system call. > > That's absolutely no use. If I can subvert your capability-aware process to > do anything, I can subvert it with _my_ code that grabs the capabilities > later. Messier, a bit harder to do. But exactly the same problem as before.
I've already admitted that this was a bad example. There is no true defense against poor programming so protecting the system by design from an exploitable hole in a program is only ever going to be an exercise in damage limitation. There can be no argument, however, that capabilities are better at damage limitation that the current setuid model.
Also "absolutely no use" is a little strong. Capabilities, and frugal use of the effective set of capabilities can help protect a large and complicated program (written by many people) from doing something bad by accident.
Cheers
Andrew
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.rutgers.edu
| |