4 ms·
To me this changes nothing to the 30% CPU wasted by default with new linux distributions. Linus said he wanted the workarounds disabled by default, why didn't
by bullen 6y ago
To me this changes nothing to the 30% CPU wasted by default with new linux distributions.
Linus said he wanted the workarounds disabled by default, why didn't anyone listen?
I'm not browsing javascript sites on my linux server!?
If the server is compromised they don't need to use meltdown/spectre to do damage since servers need root for everything useful (open port <1024)?!
- lrvick 6y agoNo, but someone that finds even an unprivileged path to execute code on your server can fully control root on it if spectre is carried out successfully.
- deleted 6y ago[deleted]
- paulryanrogers 6y agoDistros probably want to fail safe. That said most desktop installs are probably single user, so should be safe to do there
- Delk 6y agoWouldn't exploits from JavaScript specifically mean that single-user desktops aren't necessarily safe?
- paulryanrogers 6y agoYeah, I didn't recall the Javascript case until it was too late. Though I thought all browsers had reduced their timing precision to mitigate that.
- mhh__ 6y agoAnd what happens if they work out enough about your server to use ROP?
- minitech 6y ago> If the server is compromised they don't need to use meltdown/spectre to do damage since servers need root for everything useful (open port <1024)?! - there are lots of useful things you can do without root - you don’t need root to bind to port numbers below 1024 on Linux, just CAP_NET_BIND_SERVICE - when you do need root, you can usually drop it either partially or completely
- bullen 6y agoOk, thx! Can you combine that with nohup? nohup setcap 'cap_net_bind_service=+ep' blabla...
- minitech 6y agoYep! If you’re using file capabilities (setcap), it doesn’t look quite like that – you use setcap on the file separately, and then nohup when running it. You should probably run production services using something other than nohup, though, like systemd.
- amelius 6y ago> just CAP_NET_BIND_SERVICE How do you do that if you're not root? And if you are building an executable with that capability, how do you enable your Makefile to set it? I think we might need "CAP_SET_CAP_NET_BIND_SERVICE" as well. In fact, I might want to allow a user to bind to port 200 only. So in this case "CAP_SET_CAP_NET_BIND_SERVICE_PORT_200" is needed. And here we see the inflexibility of the entire approach :)
- Dylan16807 6y agoThe simple way is to use a process that has root for the smallest moment before dropping it. Which means it's vulnerable to a tiny subset of attacks, and it will never be root and serving requests at the same time.
- amelius 6y agoYes, that solves one of the problems, but it doesn't solve the problem where I want to prevent my process from binding to any other port than (say) specifically port 200.
- anyfoo 6y agoThe idea that root has absolute privileges, or even that it is, like in the olden Linux days, kernel-equivalent (through /dev/kmem, ioperm etc.), is outdated. Nowadays, the focus going forward is much more on giving every piece the privileges it needs, and not have an "absolute privilege" entity. (Outside of the kernel, although even for that it's less and less true anymore.)
- anyfoo 6y agoAs for not planning to run untrusted code in any of those pieces: It's bad if compromise through bugs of any component, however tiny, potentially leads to the ability to siphon off secrets from your server globally.
- inetknght 6y ago> The idea that root has absolute privileges, or even that it is, like in the olden Linux days, kernel-equivalent (through /dev/kmem, ioperm etc.), is outdated. No. A million times no. Absolutely no. It is not. You are doing a disservice to actual real people when you take away what they own. I own my hardware. I am root. I have absolute privileges. The idea that root has absolute privileges is the core if why I use Linux.
- megous 6y agoDon't panic, just read man capabilities and breath deeply.
- inetknght 6y agoNo. `root` should always have _full_ capabilities. Capabilities are there to allow non-root users access to some root systems
- great22221 6y agoYou are right I think. No idea why you're getting downvoted.