|
Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com |
Re: enforcing RLIMIT_NPROC in setuid() ?
From: Joerg Sonnenberger (joerg
britannica.bec.de)
Date: Fri Jan 11 2008 - 13:30:35 CST
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]
On Thu, Jan 10, 2008 at 01:43:57PM -0500, Ed Ravin wrote:
> Would it make sense to have setuid() check the process limit,
> and return an error if the user in question is over the limit?
Yes and no. The problem is that it changes the way the Unix security
model works. When Linux started to do that, they created a nice number
of root exploitable issues, because processes could not drop the setuid
and never checked for it. Isn't the check good enough if the limit gets
inherited and the process is still counted against the real uid?
Joerg
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]