Brian Beattie wrote:
Having implemented ACLs twice on Unix and Unix-like systems, I don't see
what the fetish some people have for them. Frankly juts about anything
you can do with ACLs (and anything you should want to do) you can do
with users/groups and the standard Unix/Linux permissions. Why add
unneeded cruft to the kernel.
Because instead of having an all-powerful account (which we so lovingly
know as root), you can separate specific roles to different accounts. To
use Windows' ACLs as an example:
- Adjust memory quotas for a process
- Allow/deny access to this computer from the network
- Backup files and directories
- Bypass traverse checking
- Change system time
- Increase scheduling priority
- Load and unload device drivers
- Manage auditing and security logs
- Restore files and directories
- Shutdown the system
- Take ownership of files or other objects
As you can see, those are finely-grained controls. Why would these be
useful on Linux? Because you can have a root account which can bind
Apache to a port <1024, and even if it is compromised it cannot
"shutdown the system," or "deny access to this computer from the
network," thus the attacker will be able to cause minimal damage. Yes,
the same can be done on Linux using SELinux, AppArmor, or some other ACL
system, but again - those aren't part of the kernel. They are extra
apps, and adding layers is not always the best solution when it comes to
security.
I know that some spooks think you have to
have ACLs to have a trusted system, but these are the same people who
think you need to violate my freedoms to protect them.
Um.. Forgive me for a second, but are you suggesting that a Linux system
running a service(s) under full root privileges (such as Apache) is just
as secure as a Linux system running the same process but with
compartmentalisation to make sure that each service has access to just
the files and directories it needs, achieved (currently) via AppArmor,
SELinux, or a similar ACL system? If you really do think that, you may
want to read a few more papers and/or books. If Apache is bound to port
80 as root and is not restricted (via ACLs) to just the directories,
files, libraries and whatnot that it needs access to, and it is
compromised, then the attacker has full control over your server. If you
have ACLs in place, the attacker can only access the files that Apache
has access to, thus protecting all other files on the server (and thus
greatly decreasing the chances of the attacker implementing a
hard-to-detect kernel rootkit, or some other malware).
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[Index of Archives]
[Kernel Newbies]
[Netfilter]
[Bugtraq]
[Photo]
[Stuff]
[Gimp]
[Yosemite News]
[MIPS Linux]
[ARM Linux]
[Linux Security]
[Linux RAID]
[Video 4 Linux]
[Linux for the blind]
[Linux Resources]
