| |||||||||||||
Fun with NULL pointers, part 1Fun with NULL pointers, part 1Posted Jul 21, 2009 0:26 UTC (Tue) by kpfleming (subscriber, #23250)In reply to: Fun with NULL pointers, part 1 by jengelh Parent article: Fun with NULL pointers, part 1
What? pulseaudio is setuid-root *and* allows non-privileged users to load modules into its process space? What kind of insanity is that?
(Log in to post comments)
Fun with NULL pointers, part 1 Posted Jul 21, 2009 2:13 UTC (Tue) by smurf (subscriber, #17840) [Link]
A setuid program loading unprivileged modules usually isn't a problem if that program drops its privs before doing so.
Usually.
This whole mess goes to show that security is a hard-to-solve problem.
Taking privs off pulseaudio (Linux has been capable of doing better than all-out-setuid for _how_ long, exactly ?!?) may or may not be the solution in this case, I haven't checked.
|
|||||||||||||