Messages in this thread | | | Subject | Re: RFC: disablenetwork facility. (v4) | From | (Eric W. Biederman) | Date | Fri, 01 Jan 2010 03:41:43 -0800 |
| |
daw@cs.berkeley.edu (David Wagner) writes:
> Eric W. Biederman wrote: >>The problem with the disable_network semantics you want >>is that they allow you to perform a denial of service attack >>on privileged users. An unprivileged DOS attack is unsuitable >>for a general purpose feature in a general purpose kernel. > > I'm not persuaded yet.
I won't try hard to persuade you if you drop me off the cc list.
> When you talk about DOS, let's be a bit more precise. disablenetwork > gives a way to deny setuid programs access to the network. It's not a > general-purpose DOS; it's denying access to the network only. And the > network is fundamentally unreliable. No security-critical mechanism > should be relying upon the availability of the network.
The audit daemon should not rely on netlink?
> So while I certainly can't rule out the possibility that disablenetwork > might introduce minor issues, I think there are fundamental reasons to > be skeptical that disablenetwork will introduce serious new security > problems.
For me the case is simple. I have seen several plausible sounding scenarios that get most of the way there. I know I am stupid when it comes to security and that people exploiting problems are going to be looking harder than I will. Therefore I think there is a reasonable chance this will introduce a security hole for someone.
Eric
| |