Re: New Security Features, Please Comment

[Alan Cox <alan@lxorguk.ukuu.org.uk>]

> (such as PHP) as the user that owns the website we are forced to fork a
> new process per request, then call setuid/gid and then launch the script
> language. This ofcource is resource intensive, but at present there is
> no other solution.

It's pretty much the minimal requirement for any kind of security because
you need the separate process/file environment. It's not helped by the
fact some of the scripting languages don't support an internal fork/exec
that preserves bootstrapped interpreter state but that is a different
problem.

> child processes (forked) uid/gid at any time without needing root access
> while being secure so that it can not set its child processes to users
> such as root.

You then need locking to handle all the horrible corner cases such as
changing uid during a file open. You really really want a process to
change its own uid somehow, even if that is done by some method other
than setuid.

Models that have been talked about but not implemented have included
things like passing 'authority' of some kind by file handles, so the
child receives an authority and then uses it.

Alan