lkml.org 
[lkml]   [1999]   [Apr]   [15]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: caps in elf headers: use the sticky bit!
-----BEGIN PGP SIGNED MESSAGE-----
Ted,
As for the NFS issue, there are situations where NFS can be used in a
(at least semi)secure environment. If the NFS traffic is on a dedicated
LAN (often done for performance anyway) then the only way that NFS can be
a problem is if one of your machines in hacked into anyway. The ability to
use capabilities on NFS mounted files would significantly help in server
farm situations.

A real world example.
you setup a web server farm with the common files/binarys NFS mounted.
This reduces the amount of configuration needed to setup each server. This
could be done with the binarys locally mounted, but then you have a
significant issue of keeping all the machines syncronized. If we use
something that can survive over a remote filesystem we maintain this tool
while still being able to gain the advantages of capabilities for the
programs (both the web server itself and any CGI's that it runs)

David Lang


On Thu, 15 Apr 1999 tytso@MIT.EDU wrote:

>
> What I would suggest is either using a combination of the sticky bit
> plus the immutable flag, *or* define a new ext2 flag which means "this
> file has capability information". The second is probably the better
> choice, and since it's only a bit in the flags word, it's easy enough
> to implement. Now, people will inevitably complain that this means
> you can't use other filesystems. That's correct. And I think, that's
> OK. As I mentioned, all of the other Secure OS's that have done this
> have assumed filesystem support. And you wouldn't want to use
> capabilities over NFS anyway, since NFS stands for No File Security.
> People who use capabilities are generally serious about their
> security, and it's easy enough to corrupt an executable going over the
> network via NFS to insert an attacker's trojan horse code. So running
> setuid programs over NFS is a *really* bad idea to begin with.
>
> By using a special ext2 flag meaning "there be capabilities here", and
> using the ELF header hack, it means that you do allow a program to be
> setuid daemon as well as having capabilities; and it allows you to
> build a system with the full set of capabilities in the POSIX
> capabilities models. It does mean that we will need to extend some
> tools and build a few new ones. In addition to writing a setuid
> scanner, we will need to write a capability scanner. But in the long
> run, I think the extra effort will be worth it.
>
> - Ted
>

"If users are made to understand that the system administrator's job is to
make computers run, and not to make them happy, they can, in fact, be made
happy most of the time. If users are allowed to believe that the system
administrator's job is to make them happy, they can, in fact, never be made
happy."
- -Paul Evans (as quoted by Barb Dijker in "Managing Support Staff", LISA '97)
-----BEGIN PGP SIGNATURE-----
Version: PGP for Personal Privacy 5.0
Charset: noconv
iQEVAwUBNxZxOT7msCGEppcbAQH/vAf/QrtjODol8pgiz6xABOyisT9ubqTFSzTb
wE/sBbY4WRUNss4mqahDb3vl1B8LXK+5fQn/aykaF6IC55zhZsuV6ZRPsP+Py5TS
dEYohg8KIi4una9Gan5I+gJrMCCP2LKwroE6DZoqig7zj1UXdMJVAG0CeL8YAQdI
2P5wCGF37EByU9BCnn6A1va6yOYvgG35mOWO+EXPPpEj/Wuh3fRH8FHnU7A0ayiq
MCvDVp8L+wKiJlJiPFAbwTF1C7wAr0mBak6JCoKCoE3wUKybYJtv8iYUOdUG5dKN
7vHubTbzppO2dkb7hTanS2g3Ib//PECfpAaHLptlwfo6WW/SuPpuUw==
=HPkG
-----END PGP SIGNATURE-----

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 13:51    [from the cache]
©2003-2011 Jasper Spaans