lkml.org 
[lkml]   [1999]   [Dec]   [29]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    From
    Date
    SubjectRe: Unexecutable Stack / Buffer Overflow Exploits...
    In <m123LyJ-000OVtC@amadeus.home.nl> Arjan van de Ven (arjan@fenrus.demon.nl) wrote:
    > In article <Pine.SUN.3.96.991229052840.376X-100000@invisible.eskimo.com> you wrote:
    >>> > suffice to raise major havoc. Besides if they can get a shell as ANY UID
    >>> > that gives them an inside base from which to advance their attack.

    > I would like to see an option that does the folowing:

    > 1) Let "normal user" programs bind to ports < 1024
    > ONLY IF
    > 2) that program was given this "capability" by root, for example
    > by means of an file-system flag.

    > This allows a lot of, currently, SUID-programs to run as non-root all the
    > way, and thus, when used properly, enhances security of networked systems.

    It's long story. You can do it NOW (more or less). Capabilities like this
    are in kernel. So what you should do is just adding fie lines to the very
    start of main() -- drop all capabilities there except of capability to bind
    to ports < 1024 ... Where to store such capability in filesystem was discussed
    year ago and no consensus was gotten :-((




    -
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.rutgers.edu
    Please read the FAQ at http://www.tux.org/lkml/

    \
     
     \ /
      Last update: 2005-03-22 13:55    [W:0.042 / U:0.168 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site