Messages in this thread | | | Date | Sun, 10 Jan 2010 20:45:30 -0500 | From | Michael Stone <> | Subject | Re: [PATCH 2/3] Security: Implement disablenetwork semantics. (v4) |
| |
Tetsuo Handa wrote:
>Michael Stone wrote: >> Examples of software that I want to be able to gain privileges normally include: >> >> rainbow, which requires privilege in order to add new accounts to the system >> and in order to call setuid() but which does not require networking >> privileges. > > If the system is not using local files (i.e. /etc/passwd and /etc/shadow), > the process who wants to add new accounts to the system might need network > access (e.g. to LDAP server), doesn't it?
General purpose account manipulation tools might need network access but rainbow handles all its account manipulations via state stored in /var/spool/rainbow/2. This state is made available to the rest of the system via libnss_rainbow.
Michael
| |