[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20191001150614.GF16318@brightrain.aerifal.cx>
Date: Tue, 1 Oct 2019 11:06:14 -0400
From: Rich Felker <dalias@...c.org>
To: Florian Weimer <fweimer@...hat.com>
Cc: Joshua Hudson <joshudson@...il.com>,
"musl@...ts.openwall.com" <musl@...ts.openwall.com>
Subject: Re: Re: posix_spawn
On Tue, Oct 01, 2019 at 10:44:55AM -0400, Rich Felker wrote:
> On Tue, Oct 01, 2019 at 04:15:54PM +0200, Florian Weimer wrote:
> > * Joshua Hudson:
> >
> > > You guys open to adding more extensions to posix_spawn?
> > >
> > > The code that I'm actually trying to run is setgroups;setgid;setuid so
> > > I think the use case is common.
> > >
> > > More of the security-critical code being in the library is generally a
> > > good thing.
> >
> > Rich is objecting to my glibc changes. We require unanimous consent at
> > present. Unless I can convince him that his analysis is incorrect, that
> > essentially kills further API additions in this area.
>
> Can you point me to which ones you're referring to? I'm not generally
> opposed to extensions to solve the deficiencies in posix_spawn, but
> there may be one I'm not remembering where there was something about
> it in particular that I found problematic.
Ah, if it's this particular feature, arbitrary credential changes
rather than just resetting effective ids back to real ones, then there
are concerns like in this thread about tasks with different
credentials sharing same VM space. However, I think since there's no
opportunity to control execution in the child until after execve, it
can probably be made safe; if not, CLONE_VM could be omitted when the
relevant attribute is used.
Rich
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
