linux-kernel - Re: [PATCH 2.6.18 try 2] net/ipv4: sysctl to allow non-superuser to bypass CAP_NET_BIND

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <ef0as0$c4f$1@taverner.cs.berkeley.edu>
Date:	Fri, 22 Sep 2006 09:37:04 +0000 (UTC)
From:	daw@...berkeley.edu (David Wagner)
To:	linux-kernel@...r.kernel.org
Subject: Re: [PATCH 2.6.18 try 2] net/ipv4: sysctl to allow non-superuser to bypass CAP_NET_BIND_SERVICE requirement

William Pitcock  wrote:
>Additionally, with your solution, the program would still need to be  
>extensively modified.

I suspect "extensively" may be a little bit of an overstatement, though
it sure would take some doing.  With some work, it may be possible to
write an alternative implementation of bind() that creates a Unix domain
socket, forks, execs a copy of the setuid-root program, recieves a copy
of the newly opened fd passed over the Unix domain socket, and returns
that to the caller of bind().  In this way, it might be possible to
build a solution that requires only minimal modifications to the app
(just change how it is linked).  It'd be messy and thoroughly unportable
(because it would only work on systems where that setuid program was
installed), but maybe doable.

>However, that's really not a bad idea (what you proposed). But, I  
>still believe that the sysctl patch is more flexible, especially in  
>cases where you might not have the source-code to what you are trying  
>to run (common with enterprise apps, gameserver admin panels, etc.).

Ok.  Understandable.  I leave it to others to comment further.  I'm not
advocating anything either way.
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/