Re: policy question

[Tom <tom@lemuria.org>]

On Fri, Apr 19, 2002 at 11:10:03AM +0200, Russell Coker wrote:
> > 1) Apache itself is compromised. In that case, you are where you are
> > right now, namely that the attacker has all the rights that apache has.
> > Nothing gained, but nothing lost, either.
> 
> With the suexec model someone who gains access to the Apache domain will not 
> gain direct access to the user domains, they will only be able to transition 
> to them through suexec and through the cgi-bin script.  Therefore even if the 
> Apache domain is controlled by a hostile user they still will be limited as 
> to what they can do to the user domain.

Ok, that makes sense.


> > There would be no transition between user domains. The transitions
> > allowed would be from apache to a user and from a user to apache.
> 
> Which also allows user -> apache -> other-user...
> 
> > The
> > later would happen on exit. As long as your script is still doing
> > stuff, you are in the user domain.
> 
> What do you mean by "exit"?  File close of script file?  That doesn't 
> necessarily stop code running...

Two possibilities here. One being an active transition by apache
(requesting to enter a new domain) at the end of the PHP execution. The
other being a socket close. The later would mean the process remains in
the domain during keepalive. Apache doesn't tear the socket down while
code is still running, since there may still be output being added.



-- 
http://web.lemuria.org/pubkey.html
pub  1024D/D88D35A6 2001-11-14 Tom Vogt <tom@lemuria.org>
     Key fingerprint = 276B B7BB E4D8 FCCE DB8F  F965 310B 811A D88D 35A6

--
You have received this message because you are subscribed to the selinux list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.