Re: unowned processes and who controls them (was: Re: passwd entry for uid -1
Quoth Marcus Brinkmann:
> I thought about first opening a socket and bind to it, then drop uids.
> That's not so good as running without any ids in the first place, but
> better than keeping those uids around, isn't it?
If you're talking about sockets as in TCP/IP networking, this is good
enough for a webserver and other simple protocols, but for an ftp-server
wanting to support active ftp, this won't work.
Also, without some proper filesystem support for this, there will be
problems for all services actually wanting to store something on disk.
I thought for a moment about how you could run BIND uid-less, until I
came to think of the problems you would have the _second_ time you
wanted to do a zone xfer.
Perhaps unique filesystem namespaces for each process / login group
would be a way to work around this problem.
Oystein
--
This message was generated by a flock of happy penguins.
Reply to: