Messages in this thread | | | Date | Tue, 17 Dec 1996 10:48:39 +0100 (MET) | From | Janos Farkas <> | Subject | Re: Priviledge Groups |
| |
On Tue, 17 Dec 1996 bofh@snoopy.virtual.net.au wrote: [Paul Flinders wrote:] > >For those who don't have HP-UX 10 systems handy priviledge > >groups associate groups (although I'd do it to the granularity > >of users) access to certain system capabilities. > > >HP-UX defines > > Ability to chown(2) files to some other user > > Ability to call lockf(2) on files open readonly > > Ability to lock pages in physical memory > > Ability to set realtime priorities with rtprio(2) > > Ability to set realtime priorities with the rtsched() functions > > Ability to use setuid(2) and setgid(2) > > >We could usefully add > > Ability to bind to sockets <1024 > > Ability to use mknod(2) > > Ability to create hard links to non-owned files. > > >Any others? > > Ability to run TCPDUMP and other network disgnostics programs. > Ability to run ifconfig/route and make changes to interfaces and routes. > Ability to send commands to init (ie shutdown the machine). Ability to access > the network in any way (I'd like to create guest accounts without any network > access).
The POSIX.6 patch, and working group has done something like this, only fully implemented, AFAIR.
However, I think, the only brokennes in schemes, like this, that most of these "priviledges" can be used to get access to other parts of the system. I think it would be wise to put more non-priviledges to be not accessible without special permissions. I.e. network bind(), or file write() should be allowed only to special programs, that way we could be sure that for example apache won't write to any files (well, logging is another matter.. :), or any user won't come up with a network backdoor daemon, while ftp/lynx still could work... It's a bit against the UNIX spirit to not allow everything except which should be done by the superuser, but I think splitting up the root priviledges (i.e. block reads, mounting file systems, any file write, use of restricted port range) is not enough, we should stop anyone doing what we don't want, not just give parts of the root-ness away... (which, as I said, usually can be used to get the remaining part of it..)
Janos
| |