| |||||||||||||
Removing setuidRemoving setuidPosted Nov 25, 2010 18:13 UTC (Thu) by talex (subscriber, #19139)In reply to: Removing setuid by cjwatson Parent article: Ghosts of Unix past, part 4: High-maintenance designs
That's an interesting example.
As you say, the current situation isn't great anyway. I wonder how Capsicum deals with tracing? I assume that you'd need to have a process descriptor to ptrace a process, so by default you'd only be able to trace your children.
If a process wanted to trace something else, it would have to ask a service (e.g your session manager) for a handle to the target. The session manager could refuse to hand over the handle to the ssh-agent process (or some stricter policy, like always confirming with the user).
(Log in to post comments)
Removing setuid Posted Nov 26, 2010 14:35 UTC (Fri) by Yorick (subscriber, #19241) [Link]
For a capability-based system, I would imagine tracing the user's own processes to be a question for his powerbox. I don't remember if the Capsicum papers discuss the design of a powerbox to go with the rest of the system.
|
|||||||||||||