3 ms·
I guess it wouldn't be too hard to gain root access once code runs on the server: There are plenty of local privilege attacks in the Linux Kernel and not everyb
by atesti 14y ago
I guess it wouldn't be too hard to gain root access once code runs on the server: There are plenty of local privilege attacks in the Linux Kernel and not everybody updates and reboots regularly
- antihero 14y agoBy plenty you mean "plenty if you accumulate all the legacy kernel versions", right?
- betterunix 14y agoThat does matter in the real world, since people routinely fail to update, or are unwilling to update because they cannot afford the minute or two of downtime required to reboot their servers. I know one guy who works with Solaris systems from the mid-90s that cannot be upgraded to anything more recent for various (non-technical) reasons. If security did not have a human element, these problems would have been solved long ago.
- brokenparser 14y agoThe problems already have been solved long ago, it's just a matter of cost. Ksplice can update the kernel without a reboot, but has a cost. 2 minutes of downtime has a cost. As does not having a backup server and losing the one and only production server.
- atesti 14y agoYes, of course. But for Linux kernels, for every new release for the few maintained stable kernels, they always tell you it's better to update without giving specific details if there are vulnerabilities and who is affected. I personally don't bother to upgrade all the time with minor versions (at least on the systems where the kernel is not from the distribution). Therefore, running something not as root is good, but I should still be afraid of any exploit!