Re: setuid/setgid binaries contained in the Debian repository.

[Steve Greenland <steveg@moregruel.net>]

On 11-Aug-03, 13:26 (CDT), Emile van Bergen <emile-deb@evbergen.xs4all.nl> wrote: 
> But fundamentally, there is no alternative. 

Sure there is. It's called "fine grained privileges" or somesuch, and
allows you to assign a user or program a specific set of priviliges or
capabilities needed to accomplish the task at hand. That way, when the
program is exploited, you don't give away the farm the way you do with
Unix's all-or-nothing root user. SELinux is one implementation of this
idea, althugh it's hardly new.

And no, using specific users or groups for specific tasks is NOT
equivalent, it's just the best we can do with the standard Unix security
model.

Steve

-- 
Steve Greenland
    The irony is that Bill Gates claims to be making a stable operating
    system and Linus Torvalds claims to be trying to take over the
    world.       -- seen on the net