Messages in this thread | | | Date | Wed, 29 Dec 1999 21:42:25 -0800 (PST) | From | Robert Dinse <> | Subject | Re: linux-kernel-digest V1 #4986 |
| |
On Wed, 29 Dec 1999 11:39:21 Dan Hollis <goemon@sasami.anime.net> wrote: > > On Wed, 29 Dec 1999, Arjan van de Ven wrote: > > I would like to see an option that does the folowing: > > 1) Let "normal user" programs bind to ports < 1024 > > ONLY IF > > 2) that program was given this "capability" by root, for example > > by means of an file-system flag. > > Actually someone made a patch to give traditional permissions to sockets > <1024, so you could chown/chgrp/chmod them to specific users. Far cleaner > solution in my opinion. > > - -Dan
I would very much like this, I saw something like this somewhere, I think on the Stack Guard site, but unfortunately when I tried to download it it said it wasn't ready yet.
Anybody know where a patch that does this now can be obtained?
Stack Guard unfortunately, to the best of my knowledge, is only ported to x86, anybody know of a Sparc port?
And I would still like to have the option of a non-executable stack. Even if daemons are running as another UID other than root, I would still rather not give an outside attacker a shell on my hosts from which to launch inside attacks.
Even if Stack Guard were ported to Sparc, it's too easily gotten around, and while a non-executable stack can also, it's more difficult and there isn't anything obvious to me that would prevent both from being used.
And there is no reason I can see why both can't be used AND daemons can't run as something other than root.
There are cases though where it's difficult to get around, for example, ftpd which has to do authentication and change ot a users UID. How do you do this without root?
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.rutgers.edu Please read the FAQ at http://www.tux.org/lkml/
| |