Messages in this thread | | | Subject | Re: Posix capabilities | From | Olaf Dietsche <olaf.dietsche#> | Date | Thu, 17 Oct 2002 12:37:30 +0200 |
| |
"Theodore Ts'o" <tytso@mit.edu> writes:
> Personally, I'm not so convinced that capabilities are such a great > idea. System administrators have a hard enough time keeping 12 bits > of permissions correct on executable files; with capabilities they > have to keep track of several hundred bits of capabilties flags, which
So you claim, system administrators are stupid people?
> must be set precisely correctly, or the programs will either (a) fail > to function,
Which you will notice very fast.
> or (b) have a gaping huge security hole.
Which is not worse, but possibly a lot better, than setuid root.
> This probablem could be solved with some really scary, complex user > tools (which no one has written yet). Alternatively you could just > let programs continue to be setuid root, but modify the executable to > explicitly drop all the capabilities except for the ones that are > actually needed as one of the first things that executable does. It
Which isn't convincing, either. The benefit of capabilities is to administer your system _without_ relying on someone else doing a decent job.
> perhaps only gives you 90% of the benefits of the full-fledged > capabilities model, but it's much more fool proof, and much easier to > administer.
With capabilities you don't have to resort to programming, which _is_ already an easier way to administer. This also means, distribution builders, who may not be coders, can contribute to enhance security.
Maybe this sounds like a plea for capabilities and maybe it is, but I just want to put some things straight. Unless there's something better, I stay with capabilities.
To be more constructive, I want to point to <http://www.linux.it/~md/software/ssd.tgz>. This is a modified start-stop-daemon, which allows to change capabilities. With this really scary, complex user tool (which to some extent it is, when you look at the code), I was able to drop all the capabilities except for the ones that are actually needed. ;-)
Regards, Olaf. - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |