4 ms·
Can I just point out that this is just one vivid example of why tying setuid permissions to a file is a terrible design to begin with? Permissions should be der
by mehrdadn 7y ago
Can I just point out that this is just one vivid example of why tying setuid permissions to a file is a terrible design to begin with? Permissions should be derived from the execution context at run time. (People might hate me for saying this, but this is one of those design decisions Windows fundamentally gets right.)
- 001spartan 7y agoEven Windows gets this wrong at times, with several UAC bypass techniques exposed by auto-elevating binaries. Still, Microsoft has done a great deal of work with the Windows privilege model to prevent things like this, and these issues are steadily being resolved.
- mehrdadn 7y agohttps://www.networkworld.com/article/2295224/microsoft--uac-not-a-security-feature.html https://www.networkworld.com/article/2295224/microsoft--uac-...
- orf 7y agoPasting a random article from 2007 with no other comment is not a great rebuttal of what they said. A _lot_ has changed since 2007.
- mehrdadn 7y agoI'm pretty sure the fact that it's not a security boundary has not changed since 2007. They should've probably marketed it better to clarify this, but that's not a technical issue. It was always a horrible idea to run a malicious program under your credentials relying on UAC to enforce any security. That's never changed.
- gruez 7y ago>with several UAC bypass techniques exposed by auto-elevating binaries According to Raymond Chen, a MSFT employee: >There really are only two [UAC] settings. >* Always notify >* Meh https://devblogs.microsoft.com/oldnewthing/20160816-00/?p=94105 https://devblogs.microsoft.com/oldnewthing/20160816-00/?p=94...
- saagarjha 7y agoHow do you suggest implementing passwd without setuid?
- mehrdadn 7y agoOff the top of my head? Ask a system service that has the privilege to change it for you after authenticating you.
- saagarjha 7y agoIsn’t that exactly what passwd is? A system service that has permission to change the passwords file?
- mehrdadn 7y agoNo, the point is that passwd should obtain its privilege by virtue of being started by a privileged process, not by virtue of being marked as a privileged program when it's run by an unprivileged user.
- saagarjha 7y agoHow do you start the privileged process as a normal user?
- mehrdadn 7y agoYou don't. It's already started as part of the system. Or you ask some part of the system that is willing to authenticate you to do it for you.
- exikyut 7y agoShhhhhhhhhh. Stop giving systemd more ideas. (/s) (But seriously, imagine a world where you can't get root because D-Bus crashed.)