Re: passwd entry for uid -1
Quoth Marcus Brinkmann:
> Will the following scenario work?
>
> glibc is changed, so that "setuid(-1)" means: Drop all (effective?) user ids.
> Change the nobody entry in the passwd file so that it lists -1 as uid.
>
> This will make Unix programs which conventionally switch to user nobody very
> safe (because they will run without any privileges).
Would this make it possible to run both the apache-threads and bind as
"nobody", and still have a person who cracks your bind _not_ being able
to fiddle with your apache? Would services using more than one process
still be able to work normally?
In Unix/linux, running stuff as nobody is not of much use, as if you run
two or more services as the user nobody, the cracker that gets in through
one of them will have control over all the others. (and can for example
debug/ptrace() your sshd, dumping all the passwords.) As Robert said,
"nobody" actually owning stuff is even worse.
If we could get some kind of compartmentalizing for setuid(-1), so that
the apache threads would have access to each other, but not to bind or
the ftpd, and soforth, it could work, but this would again be totally
incompatible with all other systems.
Am I totally off here? I'm not sure how you would combine "no
privileges" with "actually being able to do something useful". I'm
quite Unixified in my knowledge, so perhaps it is only a question of
unlearning a bit more ;)
Oystein
--
This message was generated by a horde of attack elephants armed with PRNGs.
Reply to: