Messages in this thread | | | Date | Sun, 10 Oct 1999 21:54:21 -0400 | From | "Theodore Y. Ts'o" <> | Subject | Re: PUBLIC CHALLENGE: (was RE: devfs again, (was RE: USB device a lloc ation) ) |
| |
Date: Sun, 10 Oct 1999 17:10:41 -0300 From: Horst von Brand <vonbrand@sleipnir.valparaiso.cl>
Security implications worry me: When a new device shows up, the devd starts some proggie to configure it (permissions, ifconfig, whatever). This will be a program with root privilege, or at least device creating/configuring capability. OK, whom is this GUI (Big mess! Hard to audit!) program going to contact? Current user at the console, only user on the machine (some vermin over the net, perhaps), wait for root to show up? Might be OK for a personal, non-networked machine. For a server it is out, AFAIKS. And then a substantial chunk of the proposed functionality is lost.
True, but for a server you're much less likely to be randomly inserting random devices into the thing. And a server is likely to have a clueful sysadmin to administer the machine. If not, the whole thing will likely be a security disaster quite quickly anyway, GUI or no GUI.
I imagine that the GUI would only be used for a single-user personal workstation. I.e., "Windows 98" mode. It doesn't matter whether it's networked or not; an attacker can't plug in a new USB scanner into the system over the network. :-) But yes, if you're going to be doing GUI work, the assumption is that the person sitting in front of the console is trusted.
This is true already with RedHat 6.0; from GNOME when you're logged into the console, when you select logout, you can ask to reboot/halt the workstation. The assumption here is that if you're in front of the console, you probably have physical access to the power switch, so you might as well be able to shut down the machine cleanly. Hopefully there's a way to disable this if a machine is being used both as a GNOME desktop and as a timesharing machine, where you don't want a non-privileged user to be able to shut down the machine. But it's very likely that if you're running a graphical desktop, it's also a single-user machine.
- Ted
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.rutgers.edu Please read the FAQ at http://www.tux.org/lkml/
| |