On Mon, 17 May 1999, Theodore Y. Ts'o wrote:
>
> My big question with Pavel's patches is that if you're just dropping
> privileges, why not just do it programmatically in the program?  

Maybe because it's often impossible without writing a new program?

Let me you all an example. Let's say that I installed a fresh copy of
Linux, and I want to run program xxx as root, but I don't quite trust it
enough to do everything, so I want to drop certain privileges. How do I do
that?

With ELF notes, there's not a way in hell I do that without compiling up
my own program. That may be acceptable to engineers, but it sure as hell
doesn't make sense, and it sure isn't very friendly.

I can't change the program - that would defeat the whole idea of having an
easy standard install and wanting to do something special. Again, even if
I had source, it wouldn't really be anything you call "user-friendly".

I =could= have a simple shell-script or other thing that just drops the
privs. Problem solved.

In short, a wrapper thing is needed. That wrapper could be a ELF
executable, and that's the simple approach, but it's not the NICE
approach.

And anything that requires me to compile anything as a MIS person is
basically not acceptable. Remember what =users= are? They are the kind of
people that want to use the system, and not care about the technical
issues. They are the kind of people who say "Ok, I want to make sure this
program doesn't do anything bad, how do I do that" on the newsgroup, and
sending them a patch to change the source code to the program is only
going to make them (justifiably) irritated.

		Linus


-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/