RE: Does sendfile() copy extended attributes?

Joseph D. Wagner
2003-12-21T19:31:54Z

> I think you read what I wrote the wrong way. Let me rephrase it:
> How can you know that function does not call an external program to
> perform its action?

Again, sendfile() is a KERNEL function.

> There actually are a few functions in the C library which work by
> calling external programs - grantpt is one I think - and it's not
> mentioned in the manual page (because it's an implementation detail).
>
> Actually I agree with you that calling external programs is a big
> risk. It should be done carefully in security conscious code.
> However you are deluded to imagine that calling functions in the C
> library is automatically safe from the those risks. That must be done
> carefully as well.

Thanks for the heads up. But a library function is at least SAFER -- not totally SAFE but SAFER than an external program -- right?

I view security as a process, not an end result. Minimizing the risk, not eliminating the risk altogether, is my goal; hence, the question about a library function call being safer than an external program.

Joseph D. Wagner