* RE: Re: [PATCH]: non-readable binaries - binfmt_misc 2.6.0-test4
@ 2003-09-03 7:16 Zach, Yoav
2003-09-03 20:08 ` insecure
0 siblings, 1 reply; 2+ messages in thread
From: Zach, Yoav @ 2003-09-03 7:16 UTC (permalink / raw)
To: torvalds; +Cc: akpm, linux-kernel
--- Linus Torvalds <torvalds@osdl.org> wrote:
>
> I don't like the security issues here. Sure, you
> "trust" the interpreter,
> and clearly only root can set the flag, but to me
> that just makes me
> wonder why the interpreter itself can't be a simple
> suid wrapper that does
> the mapping rather than having it done in kernel
> space..
>
If the binary resides on a NFS drive ( which is a very common practice )
then the suid-wrapper solution will not work because root permissions
are squashed on the remote drive.
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: Re: [PATCH]: non-readable binaries - binfmt_misc 2.6.0-test4
2003-09-03 7:16 Re: [PATCH]: non-readable binaries - binfmt_misc 2.6.0-test4 Zach, Yoav
@ 2003-09-03 20:08 ` insecure
0 siblings, 0 replies; 2+ messages in thread
From: insecure @ 2003-09-03 20:08 UTC (permalink / raw)
To: Zach, Yoav, torvalds; +Cc: akpm, linux-kernel
On Wednesday 03 September 2003 10:16, Zach, Yoav wrote:
> --- Linus Torvalds <torvalds@osdl.org> wrote:
> > I don't like the security issues here. Sure, you
> > "trust" the interpreter,
> > and clearly only root can set the flag, but to me
> > that just makes me
> > wonder why the interpreter itself can't be a simple
> > suid wrapper that does
> > the mapping rather than having it done in kernel
> > space..
>
> If the binary resides on a NFS drive ( which is a very common practice )
> then the suid-wrapper solution will not work because root permissions
> are squashed on the remote drive.
This is a NFS promlem. Do not work around it by adding crap elsewhere.
NFS has to get a decent user auth/crypto features.
I did not try it yet, but NFSv4 will address that.
--
vda
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2003-09-03 20:11 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2003-09-03 7:16 Re: [PATCH]: non-readable binaries - binfmt_misc 2.6.0-test4 Zach, Yoav
2003-09-03 20:08 ` insecure
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®