Re: RFC: Network privilege separation.

[Valdis . Kletnieks]

On Thu, 08 Jan 2009 10:43:05 GMT, Alan Cox said:

> If you have the same uid then you can just use ptrace to drive another
> task with that uid to do the creations for you. Chances are you can also
> attack shared executable files (eg that uids .bashrc)
> 
> That to me says controlling network access is only useful as part of a
> more fine grained and general purpose interface. We already have that
> interface in the form of things like SELinux. We already have systems
> actively using it to control stuff like which ports are accessed by some
> services.

Yes, the network access part *is* something that should be part of a more
general interface.  Having said that, we currently are lacking a way for a
*general user* program to say "I'm all set up, and would like to disavow any
other further resource access (except maybe r/o access as "other" to file
systems)".

It's pretty easy for stuff running as root to play setuid()/capability() games
to throw away access rights.  It's damned hard for mortal users to do it.

Attachment: pgp00000.pgp
Description: PGP signature