Messages in this thread | | | Date | Mon, 17 Nov 2014 11:37:34 +0000 | From | One Thousand Gnomes <> | Subject | Re: [PATCH 2/2] groups: Allow unprivileged processes to use setgroups to drop groups |
| |
> optional), I can do that too. The security model of "having a group > gives you less privilege than not having it" seems crazy, but > nonetheless I can see a couple of easy ways that we can avoid breaking
It's an old pattern of use that makes complete sense in a traditional Unix permission world because it's the only way to do "exclude {list}" nicely. Our default IMHO shouldn't break this.
> that pattern, no_new_privs being one of them. I'd like to make sure > that nobody sees any other real-world corner case that unprivileged > setgroups would break.
Barring the usual risk of people doing improper error checking I don't see one immediately.
For containers I think it actually makes sense that the sysctl can be applied per container anyway.
Alan
| |