Re: RFC: Network privilege separation.

Valdis.Kletnieks
2009-01-12T18:44:35Z

[-- Attachment #1: Type: text/plain, Size: 1029 bytes --]

On Thu, 08 Jan 2009 10:43:05 GMT, Alan Cox said:

> If you have the same uid then you can just use ptrace to drive another
> task with that uid to do the creations for you. Chances are you can also
> attack shared executable files (eg that uids .bashrc)
>
> That to me says controlling network access is only useful as part of a
> more fine grained and general purpose interface. We already have that
> interface in the form of things like SELinux. We already have systems
> actively using it to control stuff like which ports are accessed by some
> services.

Yes, the network access part *is* something that should be part of a more
general interface. Having said that, we currently are lacking a way for a
*general user* program to say "I'm all set up, and would like to disavow any
other further resource access (except maybe r/o access as "other" to file
systems)".

It's pretty easy for stuff running as root to play setuid()/capability() games
to throw away access rights. It's damned hard for mortal users to do it.

[-- Attachment #2: Type: application/pgp-signature, Size: 226 bytes --]