Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email email@example.com
From: Joerg Sonnenberger (joergbritannica.bec.de)
Date: Fri Jan 11 2008 - 13:30:35 CST
On Thu, Jan 10, 2008 at 01:43:57PM -0500, Ed Ravin wrote:
> Would it make sense to have setuid() check the process limit,
> and return an error if the user in question is over the limit?
Yes and no. The problem is that it changes the way the Unix security
model works. When Linux started to do that, they created a nice number
of root exploitable issues, because processes could not drop the setuid
and never checked for it. Isn't the check good enough if the limit gets
inherited and the process is still counted against the real uid?