Re: Disturbing news..

Romano Giannetti
2001-03-28T14:33:52Z

Notice: this is my first post to l-k since some bug report as old as 0.99...
so please be kind, don't beat me to hard.

On Wed, Mar 28, 2001 at 08:25:46AM -0500, Alexander Viro wrote:

> <shrug> If you run untrusted binaries - you are screwed. If you run
> them as root - all users on your system are screwed. If your MUA
> (or browser, etc.) can run untrusted code - see above.

Too true.

But with the new VFS semantics, wouldn't be possible for a MUA to make a
thing like the following:

spawn a process with a private namespace. Here a minimun subset of the
"real" tree (maybe all / except /dev) is mounted readonly. The private /tmp
and /home/user are substituted by read-write directory that are in the
"real" tree /home/user/mua/fakehome and /home/user/mua/faketmp. In this
private namespace, run the "untrusted" binary.

Now the binary can do much less harm than before, or am I missing something?
It have no access to real user data, but can use the system library and
services without changing anything in the system.

Having the read-only flag per vfs-mount is the only kernel-related thing
here, I think; all the rest is simply user-space spice :-).

Have a nice day,
Romano

--
Romano Giannetti - Univ. Pontificia Comillas (Madrid, Spain)
Electronic Engineer - phone +34 915 422 800 ext 2416 fax +34 915 411 132