Re: Does sendfile() copy extended attributes?

Jamie Lokier
2003-12-21T11:50:33Z

Joseph D. Wagner wrote:
> >> Because that violates one of the Immutable Laws of Security -- "If
> >> you're running someone else's program, it's not your program anymore."

> Not without ALREADY compromising the root account. Remember, the
> vulnerability I'm addressing is PRIVILEGE ELEVATION. You can't
> elevate privileges any higher than root.

Changing /bin/cp also requires a root compromise.

> > You are imagining a black box function which is specified to copy a
> > file and its attributes. How can you know that function does not work
> > by calling an external program?
>
> I didn't say it doesn't work. I just said that executing an
> external program is too much of a security risk.

I think you read what I wrote the wrong way. Let me rephrase it:
How can you know that function does not call an external program to
perform its action?

There actually are a few functions in the C library which work by
calling external programs - grantpt is one I think - and it's not
mentioned in the manual page (because it's an implementation detail).

Actually I agree with you that calling external programs is a big
risk. It should be done carefully in security conscious code.
However you are deluded to imagine that calling functions in the C
library is automatically safe from the those risks. That must be done
carefully as well.

-- Jamie