lkml.org 
[lkml]   [2010]   [Jan]   [10]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH 2/3] Security: Implement disablenetwork semantics. (v4)
Tetsuo Handa wrote:

>Michael Stone wrote:
>> Examples of software that I want to be able to gain privileges normally include:
>>
>> rainbow, which requires privilege in order to add new accounts to the system
>> and in order to call setuid() but which does not require networking
>> privileges.
>
> If the system is not using local files (i.e. /etc/passwd and /etc/shadow),
> the process who wants to add new accounts to the system might need network
> access (e.g. to LDAP server), doesn't it?

General purpose account manipulation tools might need network access but
rainbow handles all its account manipulations via state stored in
/var/spool/rainbow/2. This state is made available to the rest of the system
via libnss_rainbow.

Michael


\
 
 \ /
  Last update: 2010-01-11 02:45    [W:0.129 / U:0.092 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site