lkml.org 
[lkml]   [1999]   [May]   [17]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
SubjectRe: Capabilities done right [diff against 2.3.1]
Date
Lars Marowsky-Bree writes:
> "Albert D. Cahalan" <acahalan@cs.uml.edu> said:

>> You want to allow shellscripts with special powers?!?!?
>>
>> If so, you might as well start by allowing setuid shell scripts.
>> That was a massive security hole last I heard.
>
> Exactly because it is such a security leak, it might be very useful to only
> allow a _very_ specific subset of capabilities for a specific shell script
> instead of making it setuid 0. Your analogy is seriously flawed, thats the
> exact situation where capabilites are useful.

So it is only trivial to steal a few capabilites. Gee.
The hole goes something like this:

You grant a script the ability to do X, Y, and Z.
I invoke it through a symlink that I control.
The kernel starts up the interpreter you specified.
(this interpreter now has X, Y, and Z abilities)
I change the symlinks while your interpreter is loading.
Your interpreter runs my script with X, Y, and Z abilities.

Sure, I didn't get UID 0 right away. I did get the capabilites
that you were trying to protect though, and it wasn't even hard.

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 13:51    [W:0.076 / U:1.128 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site