[lkml]   [2010]   [Jan]   [11]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: [PATCH 2/3] Security: Implement disablenetwork semantics. (v4)


> * If network access is restored over suid, then we can leak data over
> ping or any number of other routes, so that's right out.


> * If network access is denied over suid, there are concerns of denial
> of service in certain configurations.

So that should be right out, too.

> * If suid is denied entirely, we have no denial of service or
> information leak concerns via the suid mechanism (since the mechanism
> is completely unusable). And if we really do need to execute something
> at an elevated privilege, we can ask a helper daemon to do it on our
> behalf.

Yes please. This is the obvious solution.

(cesky, pictures)

 \ /
  Last update: 2010-01-11 12:55    [W:0.116 / U:7.164 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site