William Pitcock wrote:
>Additionally, with your solution, the program would still need to be
>extensively modified.
I suspect "extensively" may be a little bit of an overstatement, though
it sure would take some doing. With some work, it may be possible to
write an alternative implementation of bind() that creates a Unix domain
socket, forks, execs a copy of the setuid-root program, recieves a copy
of the newly opened fd passed over the Unix domain socket, and returns
that to the caller of bind(). In this way, it might be possible to
build a solution that requires only minimal modifications to the app
(just change how it is linked). It'd be messy and thoroughly unportable
(because it would only work on systems where that setuid program was
installed), but maybe doable.
>However, that's really not a bad idea (what you proposed). But, I
>still believe that the sysctl patch is more flexible, especially in
>cases where you might not have the source-code to what you are trying
>to run (common with enterprise apps, gameserver admin panels, etc.).
Ok. Understandable. I leave it to others to comment further. I'm not
advocating anything either way.
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[Index of Archives]
[Kernel Newbies]
[Netfilter]
[Bugtraq]
[Photo]
[Stuff]
[Gimp]
[Yosemite News]
[MIPS Linux]
[ARM Linux]
[Linux Security]
[Linux RAID]
[Video 4 Linux]
[Linux for the blind]
[Linux Resources]
