Messages in this thread | | | Subject | Re: [RFC][PATCH v3] Unprivileged: Disable raising of privileges | From | (Eric W. Biederman) | Date | Thu, 31 Dec 2009 00:57:49 -0800 |
| |
Alan Cox <alan@lxorguk.ukuu.org.uk> writes:
> On Wed, 30 Dec 2009 13:36:57 -0800 > ebiederm@xmission.com (Eric W. Biederman) wrote: > >> Alan Cox <alan@lxorguk.ukuu.org.uk> writes: >> >> >> Added bprm->nosuid to make remove the need to add >> >> duplicate error prone checks. This ensures that >> >> the disabling of suid executables is exactly the >> >> same as MNT_NOSUID. >> > >> > Another fine example of why we have security hooks so that we don't get a >> > kernel full of other "random security idea of the day" hacks. >> >> Well it comes from plan 9. Except there they just simply did not >> implement suid. What causes you to think dropping the ability >> to execute suid executables is a random security idea of the day? > > Well to be fair its random regurgitated security idea of every year or > two. > > More to the point - we have security_* hooks so this kind of continuous > security proposal turdstream can stay out of the main part of the kernel. > > Cleaning up the mechanism by which NOSUID is handled in kernel seems a > good idea. Adding wacky new prctls and gunk for it doesn't, and belongs > in whatever security model you are using via the security hooks.
I am more than happy to make this a proper system call, instead of a prctl. The way this code is evolving that seems to be the clean way to handle this. No point in hiding the functionality away in a corner in shame.
In my book SUID applications are the root of all evil. They are exploitable if you twist their environment in a way they have not hardened themselves against, and simply supporting them prevents a lot of good features from being used by ordinary applications.
To get SUID out of my way I have to do something. A disable SUID from this process and it's children is a simple and direct way there. My other path is much more complicated.
As this also has security related uses it seems even better as a feature.
Eric
| |