Messages in this thread | | | Date | Tue, 12 Jan 2010 08:59:27 +0100 | From | Pavel Machek <> | Subject | Re: [PATCH 2/3] Security: Implement disablenetwork semantics. (v4) |
| |
> On Sun, 10 Jan 2010 22:58:48 +0100, Pavel Machek said: > > > Scenario 2: > > > > Mallory calls disablenetwork, calls sendmail as the first user after > > boot; sendmail can't deliver anything (its network is disabled), but > > starts forking and taking requests for other users, DoSing the mail > > delivery. > > You need to be root to start sendmail as a daemon.
Well, maybe, but mailer system where first user starts is as a daemon makes sense... same for authentication system, etc. And it was okay before disablenetwork come. Pavel
-- (english) http://www.livejournal.com/~pavelmachek (cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html
| |