Messages in this thread | | | Subject | Re: RFC: Network privilege separation. | From | Valdis.Kletnieks@vt ... | Date | Mon, 12 Jan 2009 13:44:10 -0500 |
| |
On Thu, 08 Jan 2009 10:43:05 GMT, Alan Cox said:
> If you have the same uid then you can just use ptrace to drive another > task with that uid to do the creations for you. Chances are you can also > attack shared executable files (eg that uids .bashrc) > > That to me says controlling network access is only useful as part of a > more fine grained and general purpose interface. We already have that > interface in the form of things like SELinux. We already have systems > actively using it to control stuff like which ports are accessed by some > services.
Yes, the network access part *is* something that should be part of a more general interface. Having said that, we currently are lacking a way for a *general user* program to say "I'm all set up, and would like to disavow any other further resource access (except maybe r/o access as "other" to file systems)".
It's pretty easy for stuff running as root to play setuid()/capability() games to throw away access rights. It's damned hard for mortal users to do it.
[unhandled content-type:application/pgp-signature] | |