Re: Does sendfile() copy extended attributes?

[Jamie Lokier <jamie@shareable.org>]

Joseph D. Wagner wrote:
> >> Because that violates one of the Immutable Laws of Security -- "If
> >> you're running someone else's program, it's not your program anymore."

> Not without ALREADY compromising the root account.  Remember, the
> vulnerability I'm addressing is PRIVILEGE ELEVATION.  You can't
> elevate privileges any higher than root.

Changing /bin/cp also requires a root compromise.

> > You are imagining a black box function which is specified to copy a
> > file and its attributes.  How can you know that function does not work
> > by calling an external program?
> 
> I didn't say it doesn't work.  I just said that executing an
> external program is too much of a security risk.

I think you read what I wrote the wrong way.  Let me rephrase it:
How can you know that function does not call an external program to
perform its action?

There actually are a few functions in the C library which work by
calling external programs - grantpt is one I think - and it's not
mentioned in the manual page (because it's an implementation detail).

Actually I agree with you that calling external programs is a big
risk.  It should be done carefully in security conscious code.
However you are deluded to imagine that calling functions in the C
library is automatically safe from the those risks.  That must be done
carefully as well.

-- Jamie