linux-kernel - Re: [ANNOUNCE] UidBind LSM 0.2

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <1177486102.25490.6.camel@hagrid>
Date:	Wed, 25 Apr 2007 09:28:22 +0200
From:	Roberto De Ioris <roberto@...it.it>
To:	Gerhard Mack <gmack@...erfire.net>
Cc:	linux-security-module@...r.kernel.org,
	linux-kernel <linux-kernel@...r.kernel.org>
Subject: Re: [ANNOUNCE] UidBind LSM 0.2

Il giorno mar, 24/04/2007 alle 18.11 -0400, Gerhard Mack ha scritto:
> On Tue, 24 Apr 2007, Casey Schaufler wrote:
> 
> > --- Gerhard Mack <gmack@...erfire.net> wrote:

> > If you're daring you could propose that low number ports be treated
> > the same way as other ports, with the default ownership being root and
> > the default ACL allowing only root.
> 
> ACL may be more complicated than needed when a simple GID addition would 
> make this right about perfect.


The unix way(TM) for specifying multiple uid is...ehm.. groups :)
I will add the gid,tcp_gid and udp_gid configfs attributes in the next
release.
The 'check order' will be:

uidbind/<port>/<ip>/<proto>_uid  
uidbind/<port>/<ip>/uid
uidbind/<port>/<proto>_uid
uidbind/<port>/uid
uidbind/<port>/<ip>/<proto>_gid  
uidbind/<port>/<ip>/gid
uidbind/<port>/<proto>_gid
uidbind/<port>/gid

I am investigating the possibility of port-range use, particularly the
overlap checks and performance problems.

-- 
Roberto De Ioris
http://unbit.it
JID: roberto@...ber.unbit.it
Wii: 2999 4476 3509 0964

Download attachment "signature.asc" of type "application/pgp-signature" (190 bytes)