3 ms·
> But closing your eyes and pretending everything is a file is a security disaster waiting to happen (actually, happening every day). How so? I can see the lim
by GekkePrutser 4y ago
> But closing your eyes and pretending everything is a file is a security disaster waiting to happen (actually, happening every day).
How so? I can see the limited access control in Linux is an issue, and for this reason augmented security MAC (Mandatory Access Control) controls exist like SELinux and AppArmor.
But I don't see how the nature of everything being a file is a vulnerability in itself.
I'd be happy to learn how though.
- deleted 4y ago[deleted]
- dist1ll 4y agoIt was a lame attempt at humor, a roundabout way of referring to the simplifying assumptions that *nix systems generally make of the underlying machine.
- fanf2 4y agoIf you want to follow the principles of capability security, then a key part of the strategy is to eliminate “ambient authority”, that is, any kind of globally accessible way of obtaining a capability. In traditional unix-like systems, file descriptors are very close to capabilities. But the global filesystem namespace is a source of ambient authority. There are a couple of ways to fix this issue: fine-grained per-process namespaces like Plan 9, so that the filesystem’s authority can be attenuated as necessary, so it becomes more like a capability. Or eliminate absolute pathnames from the API, so you have to use functions like openat() to get an fd relative to an existing fd.