Linux-kernel mailing list archive 1998-31,: Re: [PATCH] [SECURITY] suid procs exec'd with bad 0,1,2 fds

# Re: [PATCH] [SECURITY] suid procs exec'd with bad 0,1,2 fds

Brandon S. Allbery KF8NH (allbery@kf8nh.apk.net)
Tue, 04 Aug 1998 21:07:47 -0300

- Messages sorted by: [ date ][ thread ][ subject ][ author ]
- Next message: Perry Harrington: "Re: [PATCH] [SECURITY] suid procs exec'd with bad 0,1,2 fds"
- Previous message: Alan Cox: "Re: [PATCH] [SECURITY] suid procs exec'd with bad 0,1,2 fds"
- Maybe in reply to: Zachary Amsden: "[PATCH] [SECURITY] suid procs exec'd with bad 0,1,2 fds"
- Next in thread: Dean Gaudet: "Re: [PATCH] [SECURITY] suid procs exec'd with bad 0,1,2 fds"
- Reply: Dean Gaudet: "Re: [PATCH] [SECURITY] suid procs exec'd with bad 0,1,2 fds"

In message <Pine.LNX.3.96dg4.980804142900.28083a-100000@twinlark.arctic.org>
, D
ean Gaudet writes:
+-----
| It's an arms race no matter how you look at it. firewalling is in the
| kernel. If systems were built to be secure in the first place it wouldn't
| be needed. But it's there anyhow. Does that let folks worry a bit less
| about things inside their firewall? yes. Does that lead to less secure
| systems inside the firewall? yes. How is it different from
| no-stack-exec?
+--->8

Because it's a deliberate tradeoff: it allows you to provide limited
Internet access from inside the firewall without opening everything up ---
important when "everything" includes commercial database servers of unknown
security, network printers (Postscript is a Turing-equivalent programming
language, it's not unthinkable that someone could craft an exploit that uses
a Postscript printer as an intermediary), and client boxes that might be
secure when you set them up but are afterwards left to the mercy of users
who love to install the latest un-audited code (including various products
from a certain very large software company...).

You're accepting a security risk (while trying to minimize it) in return for
increased functionality. The no-stack-exec patch doesn't do this.

(That doesn't mean I disapprove of the no-stack-exec patch, by the way; I
personally think user programs that want to execute code off the stack are
broken by design --- and I seem to recall that the signal trampoline code
was added to Linux only when we couldn't get away from it any more, so I
can't be the only one that finds the idea ugly.)

    --
    brandon s. allbery	[os/2][linux][solaris][japh]	 allbery@kf8nh.apk.net
    system administrator	     [WAY too many hats]	   allbery@ece.cmu.edu
    electrical and computer engineering
    carnegie mellon university			   (bsa@kf8nh is still valid.)

    -
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.rutgers.edu
    Please read the FAQ at http://www.altern.org/andrebalsa/doc/lkml-faq.html

- Next message: Perry Harrington: "Re: [PATCH] [SECURITY] suid procs exec'd with bad 0,1,2 fds"
- Previous message: Alan Cox: "Re: [PATCH] [SECURITY] suid procs exec'd with bad 0,1,2 fds"
- Maybe in reply to: Zachary Amsden: "[PATCH] [SECURITY] suid procs exec'd with bad 0,1,2 fds"
- Next in thread: Dean Gaudet: "Re: [PATCH] [SECURITY] suid procs exec'd with bad 0,1,2 fds"
- Reply: Dean Gaudet: "Re: [PATCH] [SECURITY] suid procs exec'd with bad 0,1,2 fds"