4 ms·
Nowadays, depending on the OS and it's configuration, root is not necessarily the end to end all things, but if the servers in question were "normally configure
by anyfoo 5y ago
Nowadays, depending on the OS and it's configuration, root is not necessarily the end to end all things, but if the servers in question were "normally configured" Linux servers a number of years ago, it was likely equivalent to total access. Including control of the kernel through things like /dev/mem, /dev/kmem, and /dev/ports, which at least were common and accessible to root a while ago.
With newer stuff in certain configurations, something that gives you remote execution in the kernel or even lower (your Intel ME Engine example seems like a good one) is a much worse security hole, yeah (but then this one could still be a stepping stone to the worse bug).
- T3OU-736 5y agoTCSEC [1] levels high enough specified that root wasn't omnipotent, nor could do things unilaterally, and never without logging. B2 and higher, if memory serves. SGI's IRIX could be a part of a B2-level installation (because criteria was applicable to more than just the OS). So much wheel reinvention sometimes... [1] https://en.m.wikipedia.org/wiki/Trusted_Computer_System_Evaluation_Criteria https://en.m.wikipedia.org/wiki/Trusted_Computer_System_Eval...
- anyfoo 5y agoYeah, I tried to qualify my statement a lot ("normally configured", "Linux server", "number of years ago"...). But I think the subjective viewpoint I gave is probably familiar to a lot of people that used to deal with commodity Linux servers. I share the sentiment with the wheel reinvention, though. This will continue happening...
- Y_Y 5y ago> So much wheel reinvention sometimes... Users on this system are not permitted to make UNIX puns. This incident will be reported.