lkml.org 
[lkml]   [2010]   [Jan]   [1]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: RFC: disablenetwork facility. (v4)
From
Date
daw@cs.berkeley.edu (David Wagner) writes:

> Eric W. Biederman wrote:
>>The problem with the disable_network semantics you want
>>is that they allow you to perform a denial of service attack
>>on privileged users. An unprivileged DOS attack is unsuitable
>>for a general purpose feature in a general purpose kernel.
>
> I'm not persuaded yet.

I won't try hard to persuade you if you drop me off the cc list.

> When you talk about DOS, let's be a bit more precise. disablenetwork
> gives a way to deny setuid programs access to the network. It's not a
> general-purpose DOS; it's denying access to the network only. And the
> network is fundamentally unreliable. No security-critical mechanism
> should be relying upon the availability of the network.

The audit daemon should not rely on netlink?

> So while I certainly can't rule out the possibility that disablenetwork
> might introduce minor issues, I think there are fundamental reasons to
> be skeptical that disablenetwork will introduce serious new security
> problems.

For me the case is simple. I have seen several plausible sounding
scenarios that get most of the way there. I know I am stupid when
it comes to security and that people exploiting problems are going
to be looking harder than I will. Therefore I think there is
a reasonable chance this will introduce a security hole for someone.

Eric


\
 
 \ /
  Last update: 2010-01-01 13:05    [W:1.813 / U:0.020 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site