On Thu, Oct 30, 2014 at 7:48 AM, Djalal Harouni <tixxdz@xxxxxxxxxx> wrote: > On Thu, Oct 30, 2014 at 05:15:04AM -0700, Eric W. Biederman wrote: >> Djalal Harouni <tixxdz@xxxxxxxxxx> writes: >> What others are doing makes it very hard to safely use allow those >> ioctls in a tightly sandboxed application, as it is unpredictable >> what the sandboxed ioctl can do with the file descriptor. >> >> Further an application that calls setresuid at different times during >> it's application will behave differently. Which makes ioctls that do >> not have consistent behavior after open time inappropriate for use in >> userspace libraries. > We are consistent in our checks, you say that the application will > behave differently when it calls setresuid() sure! If it changes its > creds then regain of course it will behave differently! and the checks > are here to make sure that setresuid() and alike work correctly when the > application changes its creds and calls-in. > Except that it isn't consistent. If I open a postgresql socket that wants me to be root and then I drop privileges, I can keep talking to postresql. This is a good thing, because it means that I can keep talking to postgresql but I lose my privilege to do other things. The new kdbus model breaks this. If I start as root and drop privileges to UID_PRIVSEP, then my attempts to communicate over already-open connections shouldn't consider UID_PRIVSEP. In the, they shouldn't tell the other endpoints that UID_PRIVSEP exists at all unless I've explicitly asked the kernel for this behavior. I suggest reading up on the object capability model. Linux isn't one, but large deviations (like kdbus') from an object capability model are rarely a good thing. --Andy -- To unsubscribe from this list: send the line "unsubscribe linux-api" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
