5 ms·
whack-run is a separate C binary for this very reason: https://github.com/mwilliamson/whack-run https://github.com/mwilliamson/whack-run Whack itself is run w
by mwilliamson 13y ago
whack-run is a separate C binary for this very reason:
https://github.com/mwilliamson/whack-run https://github.com/mwilliamson/whack-run
Whack itself is run with normal privileges.
- deleted 13y ago[deleted]
- mwilliamson 13y agoI'm no Linux security expert, so any advice on that front is hugely appreciated. whack-run is supposed to drop any privileges it holds when it runs "setgid(getgid())" and "setuid(getuid())", and it exits early if either of those calls fail. Is there any reason why that wouldn't work?
- asveikau 13y agoI deleted the comment shortly seemingly before you replied, because I saw the setuid syscall. So I may have been overly paranoid.