From owner-freebsd-security Fri Apr 17 14:30:56 1998 Return-Path: Received: (from majordom@localhost) by hub.freebsd.org (8.8.8/8.8.8) id OAA01204 for freebsd-security-outgoing; Fri, 17 Apr 1998 14:30:56 -0700 (PDT) (envelope-from owner-freebsd-security@FreeBSD.ORG) Received: from fledge.watson.org (root@FLEDGE.RES.CMU.EDU [128.2.91.116]) by hub.freebsd.org (8.8.8/8.8.8) with ESMTP id VAA01155; Fri, 17 Apr 1998 21:30:36 GMT (envelope-from robert@cyrus.watson.org) Received: from trojanhorse.pr.watson.org (trojanhorse.pr.watson.org [192.0.2.10]) by fledge.watson.org (8.8.8/8.8.8) with SMTP id RAA01029; Fri, 17 Apr 1998 17:30:22 -0400 (EDT) Date: Fri, 17 Apr 1998 17:33:00 -0400 (EDT) From: Robert Watson X-Sender: robert@trojanhorse.pr.watson.org Reply-To: Robert Watson To: Dima Ruban cc: Matthew Hunt , stable@FreeBSD.ORG, freebsd-security@FreeBSD.ORG Subject: Re: kernel permissions (part II) In-Reply-To: <199804170645.XAA13015@burka.rdy.com> Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk On Thu, 16 Apr 1998, Dima Ruban wrote: > How about change like this (I didn't implement it yet, but it's not be a big > deal). > Right now we have a mount flag "nosuid". It serves it's mission, > but I'd love to have some flexibility on this. > Example is ISP enviroment (again :-). You want to allow users to have > suid to them programs, but at the same time you feel bad about having > suid programs for uids less than something (let's say 100). > > How about to implement this? Via mount options or something else? > Let's say, one wants to allow users to have suid programs, if uid on suid > program is greater than N and less than M. I was playing with this idea at one point, but still am not sure it is the best solution. One thing that might be nice to see (if layering support gets fixed) would be a POSIX capabilities layer to reduce the number of setuid programs needed. In an ISP environment, what setuid programs do you have in mind that users would use? I have never tried the setuid cgi wrapper I've heard described in the context of apache, for example. Robert N Watson ---- Carnegie Mellon University http://www.cmu.edu/ Trusted Information Systems http://www.tis.com/ SafePort Network Services http://www.safeport.com/ robert@fledge.watson.org http://www.watson.org/~robert/ To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe security" in the body of the message