Messages in this thread | | | Date | Wed, 14 Apr 1999 10:28:37 -0400 (EDT) | From | "David L. Parsley (lkml account)" <> | Subject | Re: caps in elf, next itteration (the hack get's bigger) |
| |
Hi Pavel, Ain't it fun trading e-mail in a few minutes across the planet? Heh...
On Wed, 14 Apr 1999, Pavel Machek wrote:
> Aha. Forgoet what I said. You > are right - you want kernel to change _both_ bits at one request, > which will work. Nice.
Yes, I was very happy when Eric suggested the immutable bit, since it allows us to solve both the problem of older kernels plus utility compatibility.
> > > Well - it changes something. You'll have to go out and tell everyone > > > "stickybit + immutable is deadly combination". Many times. > > > > Yes, but consider _who_ will be the pioneers to first check the "CAP-ELF > > support (experimental)" box in kernel configuration. The help should say > > "Don't check this box without knowing what you're doing; it completely > > changes the UNIX security model. For documentation, see..." > > Yes. And with my suid scheme, I could just compile it into kernel > unconditionally, and would not need to tell anyone. See the > difference?
But, as far as I can tell, setuid0 only helps us with binaries that were formerly run full setuid-root, where the stickable solution secures executables that formerly were just _run_ by root. I do _not_ want binaries to inherit everything.
> Pavel > -- > The best software in life is free (not shareware)! Pavel > GCM d? s-: !g p?:+ au- a--@ w+ v- C++@ UL+++ L++ N++ E++ W--- M- Y- R+ >
cheers, David
- -- David L. Parsley Network Specialist City of Salem Schools
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.rutgers.edu Please read the FAQ at http://www.tux.org/lkml/
| |