lkml.org 
[lkml]   [1998]   [Jun]   [8]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: Bind to privileged (<1024) ports
    On Mon, 8 Jun 1998, Winfried Truemper wrote:
    [snipped]
    > This would require only be a few extra bytes added to kernel code and
    > data, but would limit the impact of security holes in daemons running
    > (traditionally) as root. Think of the recent bind vulnerability.

    i'm sure this would be a nice feature but it would make programmers even
    more security lax. bind has the capacity to run as a non-privileged user
    as do most daemons.

    if it doesn't need to run as root, put it >1023. otherwise, either bind
    and drop permissions or maintain a vigilant security stance.

    allowing non-priveleged uids to bind in this region opens a plethura of
    potential problems. an admin who is lax in this and sets up his machine
    this way likely hasn't determined that all programs that are suid to this
    uid are secured.

    we could go on and on about this, but this is really a copout for bad
    programming in the first place and really should be dealt with in
    userland.

    -d
    --
    Please read the linux/Documentation/ files and review the last week of mail
    on linux-kernel before posting your problem.
    PLEASE don't quote _many_ lines and type _few_ lines
    -thx


    -
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.rutgers.edu

    \
     
     \ /
      Last update: 2005-03-22 13:43    [W:0.018 / U:122.148 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site