From: Blaisorblade <blaisorblade@yahoo.it>
To: user-mode-linux-devel@lists.sourceforge.net
Cc: Steve Schmidtke <steve_schmidtke@hotmail.com>, kraxel@bytesex.org
Subject: Re: [uml-devel] RE: uml_switch security fixing
Date: Wed, 9 Mar 2005 20:31:43 +0100 [thread overview]
Message-ID: <200503092031.43707.blaisorblade@yahoo.it> (raw)
In-Reply-To: <BAY24-F357DBC6F37DC0BCFA0926483510@phx.gbl>
On Wednesday 09 March 2005 19:53, Steve Schmidtke wrote:
> Blaisorblade wrote:
> >But an unpatched UML won't work with a newer uml_net binary (for SLIP
> > usage only and only for closing the interface, I mean), right?
> Correct. I think uml_net would need to manage a database of who opened
> what to do what you suggest.
Not going to implement it because nobody uses SLIP for what we can see.
> >I also looked at the versioning for uml_net, but what happens is that we
> >can
> >only stop unpatched uml_net from working with newer UML for any protocol,
> >not
> >anything else. So I won't change that. However, I just saw that we did it
> >correctly until Version 3 of the uml_net protocol...
> >I wonder what has happened after.
> I'd like to know this too. It is odd that it was only the shutdown of the
> interface that changed, it worked perfectly well before.
> > > Agreed, tuntap is a compile time option, slip should be as well.
> >
> >Ok... tuntap is compile-time because of a rough check for host support.
>
> Yes, but uml_net is suid. I may not want my users to be able to set up
> slip devices on their own (why? I don't know, I'm just paranoid that way).
Correct... And this holds especially for TUN/TAP: I think that giving TUN/TAP
away to everybody makes it possible for unprivileged users to send raw
packets, which normally is permitted only to root.
--
Paolo Giarrusso, aka Blaisorblade
Linux registered user n. 292729
http://www.user-mode-linux.org/~blaisorblade
-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click
_______________________________________________
User-mode-linux-devel mailing list
User-mode-linux-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/user-mode-linux-devel
next prev parent reply other threads:[~2005-03-09 19:32 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2005-03-07 4:42 [uml-devel] RE: uml_switch security fixing Steve Schmidtke
2005-03-09 10:34 ` Blaisorblade
2005-03-09 18:53 ` Steve Schmidtke
2005-03-09 19:31 ` Blaisorblade [this message]
2005-03-12 5:48 ` Jeff Dike
-- strict thread matches above, loose matches on Subject: below --
2005-03-02 14:53 [uml-devel] " Blaisorblade
2005-03-03 12:47 ` [uml-devel] " Nuutti Kotivuori
2005-03-09 9:23 ` Blaisorblade
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=200503092031.43707.blaisorblade@yahoo.it \
--to=blaisorblade@yahoo.it \
--cc=kraxel@bytesex.org \
--cc=steve_schmidtke@hotmail.com \
--cc=user-mode-linux-devel@lists.sourceforge.net \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox