lkml.org 
[lkml]   [2006]   [Apr]   [18]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    SubjectRe: Time to remove LSM (was Re: [RESEND][RFC][PATCH 2/7] implementation of LSM hooks)
    From
    Date
    On Tue, 18 Apr 2006 13:13:03 PDT, Crispin Cowan said:
    > This gives the system administrator the ability to force applications to
    > "drop" privs even when the application developer didn't bother, or (as
    > was the case in a Sendmail vulnerability several years ago) the
    > application *tried* to drop privs and got it wrong, so was running as
    > full root anyway.

    Interestingly enough, the Sendmail bug was a case where it was forced to "drop"
    some privs, and then it didn't have enough privs to drop the rest of the privs.

    In other words, it's quite possible to accidentally introduce a vulnerability
    that wasn't exploitable before, by artificially restricting the privs in a way
    the designer didn't expect. So this is really just handing the sysadmin
    a loaded gun and waiting.

    (Incidentally, both SELinux and presumably AppArmor have the same problem - it
    is really hard to convince yourself that you've identified *all* the access that
    a given program needs. People keep finding ways to excersize previously untested
    code paths and error handlers, resulting in a game of whack-a-mole as the program
    fails due to a lack of permissions. This is especially fun to debug when the
    program is already in an error handler... ;)

    [unhandled content-type:application/pgp-signature]
    \
     
     \ /
      Last update: 2006-04-19 01:05    [W:5.793 / U:0.180 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site