lkml.org 
[lkml]   [1998]   [Apr]   [22]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [patch 2.1.97] more capabilities support

> > The capability model is designed to change this. The recommended
> > behavior for an executable on a fully capability-aware system is to
> > not raise "effective" capabilities on startup. Since, without them, it
> > has no immediate power. In order to become powerful, it needs to
> > request that one or more of its permitted capabilities be made
> > effective, with a system call.
>
> That's absolutely no use. If I can subvert your capability-aware process to
> do anything, I can subvert it with _my_ code that grabs the capabilities
> later. Messier, a bit harder to do. But exactly the same problem as before.

I've already admitted that this was a bad example. There is no true
defense against poor programming so protecting the system by design
from an exploitable hole in a program is only ever going to be an
exercise in damage limitation. There can be no argument, however,
that capabilities are better at damage limitation that the current
setuid model.

Also "absolutely no use" is a little strong. Capabilities, and frugal
use of the effective set of capabilities can help protect a large and
complicated program (written by many people) from doing something bad
by accident.

Cheers

Andrew

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu

\
 
 \ /
  Last update: 2005-03-22 13:42    [W:0.064 / U:0.332 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site