[lkml]   [1998]   [Aug]   [4]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: [PATCH] [SECURITY] suid procs exec'd with bad 0,1,2 fds

On Tue, 4 Aug 1998, Brandon S. Allbery KF8NH wrote:

> Because it's a deliberate tradeoff: it allows you to provide limited
> Internet access from inside the firewall without opening everything up ---
> important when "everything" includes commercial database servers of unknown
> security [...]

Explain to me how a firewall is protecting your database, to which you
have no source, from buffer overflow attacks. I missed that part.

Oh wait, you've got all your CGIs/whatever-your-fav-dyn-content-is
magically tweaked to never send the "wrong" strings to the db server,

Oh! Oh! I know! You're running the db on solaris with stack exec turned


> You're accepting a security risk (while trying to minimize it) in return for
> increased functionality. The no-stack-exec patch doesn't do this.

How is the firewall increasing your functionality? As far as I can see it
restricts your functionality. So does no-stack-exec. So do passwords.
So does using a bounds checking language. So does taintperl. They all
solve specific problems, no single one of them is a complete security

Ok I'm getting tired of arguing, could someone invoke the nazi rule?


To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to
Please read the FAQ at

 \ /
  Last update: 2005-03-22 13:43    [from the cache]
©2003-2014 Jasper Spaans. hosted at Digital Ocean