[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20030422230100.GA774@openwall.com>
Date: Wed, 23 Apr 2003 03:01:00 +0400
From: Solar Designer <solar@...nwall.com>
To: owl-users@...ts.openwall.com
Subject: Re: Next Release
On Tue, Apr 22, 2003 at 03:17:15PM -0500, Steve Bremer wrote:
> Is it possible in 2.2.x to have ping and traceroute use capabilities
> and drop all other root privs shortly after startup?
They do already, -- before even parsing command line options. And
this doesn't require capabilities, only a raw socket fd is kept.
But the real danger here isn't with ping and traceroute themselves,
but rather with generic SUID/SGID program startup code: in libc, in
the dynamic linker, and even in the kernel itself. While the kernel
is highly privileged either way, there may still be logic errors in it
where the executing program's new effective credentials would be
leaked or misused. We've seen several kernel vulnerabilities of this
nature in the past.
--
/sd
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
