[lkml]   [1999]   [Apr]   [15]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: caps in elf headers: use the sticky bit!

As for the NFS issue, there are situations where NFS can be used in a
(at least semi)secure environment. If the NFS traffic is on a dedicated
LAN (often done for performance anyway) then the only way that NFS can be
a problem is if one of your machines in hacked into anyway. The ability to
use capabilities on NFS mounted files would significantly help in server
farm situations.

A real world example.
you setup a web server farm with the common files/binarys NFS mounted.
This reduces the amount of configuration needed to setup each server. This
could be done with the binarys locally mounted, but then you have a
significant issue of keeping all the machines syncronized. If we use
something that can survive over a remote filesystem we maintain this tool
while still being able to gain the advantages of capabilities for the
programs (both the web server itself and any CGI's that it runs)

David Lang

On Thu, 15 Apr 1999 tytso@MIT.EDU wrote:

> What I would suggest is either using a combination of the sticky bit
> plus the immutable flag, *or* define a new ext2 flag which means "this
> file has capability information". The second is probably the better
> choice, and since it's only a bit in the flags word, it's easy enough
> to implement. Now, people will inevitably complain that this means
> you can't use other filesystems. That's correct. And I think, that's
> OK. As I mentioned, all of the other Secure OS's that have done this
> have assumed filesystem support. And you wouldn't want to use
> capabilities over NFS anyway, since NFS stands for No File Security.
> People who use capabilities are generally serious about their
> security, and it's easy enough to corrupt an executable going over the
> network via NFS to insert an attacker's trojan horse code. So running
> setuid programs over NFS is a *really* bad idea to begin with.
> By using a special ext2 flag meaning "there be capabilities here", and
> using the ELF header hack, it means that you do allow a program to be
> setuid daemon as well as having capabilities; and it allows you to
> build a system with the full set of capabilities in the POSIX
> capabilities models. It does mean that we will need to extend some
> tools and build a few new ones. In addition to writing a setuid
> scanner, we will need to write a capability scanner. But in the long
> run, I think the extra effort will be worth it.
> - Ted

"If users are made to understand that the system administrator's job is to
make computers run, and not to make them happy, they can, in fact, be made
happy most of the time. If users are allowed to believe that the system
administrator's job is to make them happy, they can, in fact, never be made
- -Paul Evans (as quoted by Barb Dijker in "Managing Support Staff", LISA '97)

Version: PGP for Personal Privacy 5.0
Charset: noconv


To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to
Please read the FAQ at

 \ /
  Last update: 2005-03-22 13:51    [W:0.120 / U:2.136 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site