On Mon, 28 Dec 2009 11:10:06 +0100, Pavel Machek said:

> a) make disablenetwork reset to "enablenetwork" during setuid exec

That won't work either.  If you only make it 'setuid==0' binaries, you still
break 'setuid-FOO' binaries that require the net. If you just check the setuid
bit, it allows a trivial escape by creating a setuid-yourself binary and using
that to exec something else (now with network access, because we apparently
don't have a way to remember the previous setting).

> b) disallow setuid execs for tasks that have network disabled.

This is probably safer...