> is there a way to get a somewhat "lightweight" Posix 1.e? I'm thinking
> about an supplement for "if (!suser())" when binding to ports. A small
> table of the form
>
> #port uids
> 25 8 # mail
> 80 39 # httpd
>
> could allow a httpd running as UID 39 (which is associated with the login
> "httpd") to bind to port 80 without root-privileges. The table could be
> named /etc/bind_perm and activated by
>
> cat /etc/bind_perm > /proc/kernel/net/bind_perm
>
> This would require only be a few extra bytes added to kernel code and
> data, but would limit the impact of security holes in daemons running
> (traditionally) as root. Think of the recent bind vulnerability.
Check out the capabilities stuff that Andrew Morgan <morgan@transmeta.com>
has done recently, and the libpcap pointer he posted not so long ago.
(Message attached). In particular look at CAP_NET_BIND_SERVICE in
/linux/capabilites.h for details.
All recent kernels have this.
-Chris
--jI8keyz6grp/JLjh
Content-Type: message/rfc822; charset=us-ascii
Content-Disposition: attachment; filename="am.mesg"
Date: Sat, 6 Jun 1998 19:41:26 -0700
Message-Id: <199806070241.TAA17945@blighty.transmeta.com>
From: Andrew Morgan <morgan@transmeta.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
To: linux-kernel@vger.rutgers.edu
Subject: libcap-0.104
X-Mailer: VM 6.22 under 19.15 XEmacs Lucid
X-Orcpt: rfc822;linux-kernel@vger.rutgers.edu
Sender: owner-linux-kernel@vger.rutgers.edu
X-Loop: majordomo@vger.rutgers.edu
Hi,
In case you were wondering what all the capability changes were
supposed to do and would like to read about them/play/find
bugs... Here is the library that makes it all work something like the
last (15) POSIX draft for POSIX 6 -> POSIX.1e -> ???
ftp://linux.kernel.org/pub/linux/libs/security/linux-privs/kernel-2.1/
Download: libcap-0.104.tar.gz
Cheers
Andrew
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
--jI8keyz6grp/JLjh--
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu