lkml.org 
[lkml]   [1998]   [Jun]   [25]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: Secure-linux and standard kernel
    MOLNAR Ingo wrote:
    >
    > On Wed, 24 Jun 1998, Mitchell Blank Jr wrote:
    >
    > > Andi Kleen wrote:
    > > > If you want to make this secure you hooks in the startup code to drop priviledges even
    > > > earlier I think.
    > >
    > > Yuk.
    > >
    > > The real fix will come in 2.3 when ext2 can interface with the capabilities
    > > stuff. Until then, this will help things. Coming up with an ugly kludge
    > > (different startup code, different ld.so, etc) is just a distraction from
    > > real goals like:
    > >
    > > 1. Making sure the startup code and ld.so are bullet-proof. If this isn't
    > > the case the system isn't going to be secure worth a damn anyway.
    > > Avoiding the problem for a few binaries by writing an alternate loader
    > > only results in there being more of this code around to audit.
    > >
    > > 2. Working towards the filesystem set-capability stuff as mentioned above.
    >
    > the point is, we dont even need the filesystem set-capability stuff. By
    > including this feature in the ELF loading mechanizm somehow, _all_
    > filesystems (that support setuid root) will benefit from this, not only
    > ext2fs. Theoretically, we only need a single bit in the inode to indicate
    > that a binary is trusted. The rest can be done in ELF-land.

    This may sound over the top, but follow the logic here.

    Here is a crazy Idea, what about having all suid / dangerous programs be
    split into client /server through unix domain sockets. You could then
    chroot an envoronment for users that would have access to the unix
    domain files, and never have a user execute suid ever agian. I know
    that getting programs to work under this environment would be a hassle,
    but for truly secure systems, it would be nice to be sure that users
    cannot execute privledged code ever, execpt through a set protocol. Any
    devience could be logged, and the system could also track users if
    neccessary.

    Any takers?



    -Eric

    -
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.rutgers.edu

    \
     
     \ /
      Last update: 2005-03-22 13:43    [W:4.311 / U:0.332 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site