Restricting the network

Posted Jan 18, 2010 6:09 UTC (Mon) by kleptog (subscriber, #1183)
Parent article: Restricting the network

I've never quite understood the use-case for restricting setuid(). Non-root users can't use it anyway and for root users its use is to *reduce* your privileges, so why would you ever want to forbid it?

What use I can see is preventing the setuid bit on executables taking effect, but that has nothing to do with the setuid() call.

Restricting the network

Posted Jan 18, 2010 7:26 UTC (Mon) by hppnq (guest, #14462) [Link]

Most or all references to setuid in the article are to the permission bit, not the function call. The parentheses are a bit unfortunate.

That said, the setuid bit and the setuid() function are quite intimately connected: setuid() allows a program to drop privileges that might be elevated by means of a setuid bit. Either one does not make much sense without the other.

The main reasons why one should consider not using the setuid/setuid() mechanism are that it is not widely understood and not very portable. See, for instance, this paper (PDF).