lkml.org 
[lkml]   [1999]   [Dec]   [30]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: linux-kernel-digest V1 #4986
On Wed, 29 Dec 1999 11:39:21 Dan Hollis <goemon@sasami.anime.net> wrote:
>
> On Wed, 29 Dec 1999, Arjan van de Ven wrote:
> > I would like to see an option that does the folowing:
> > 1) Let "normal user" programs bind to ports < 1024
> > ONLY IF
> > 2) that program was given this "capability" by root, for example
> > by means of an file-system flag.
>
> Actually someone made a patch to give traditional permissions to sockets
> <1024, so you could chown/chgrp/chmod them to specific users. Far cleaner
> solution in my opinion.
>
> - -Dan

I would very much like this, I saw something like this somewhere, I think
on the Stack Guard site, but unfortunately when I tried to download it it said
it wasn't ready yet.

Anybody know where a patch that does this now can be obtained?

Stack Guard unfortunately, to the best of my knowledge, is only ported to
x86, anybody know of a Sparc port?

And I would still like to have the option of a non-executable stack. Even
if daemons are running as another UID other than root, I would still rather not
give an outside attacker a shell on my hosts from which to launch inside
attacks.

Even if Stack Guard were ported to Sparc, it's too easily gotten around,
and while a non-executable stack can also, it's more difficult and there isn't
anything obvious to me that would prevent both from being used.

And there is no reason I can see why both can't be used AND daemons can't
run as something other than root.

There are cases though where it's difficult to get around, for example,
ftpd which has to do authentication and change ot a users UID. How do you do
this without root?




-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 13:55    [W:0.366 / U:0.612 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site