On Dec 2 13:43, andrea wrote: > Hi all, > > Our company is looking at some security properties of cygwin. We want to > run a daemon like sshd in a multi user environment with cygrunsrv. > > There was an entry [0] in your FAQ from 2000/09/13 that cygwin is not > secure in a multi user environment. This entry was replaced this year > [1], that as of 1.5.13 you are not aware of any feature to gain more > privileges than you have under Windows. For my understanding is this > newest FAQ entry in contrast to what you write in your user guide [2] > about the use of shared memory in your 'kernel'. There you write > "...it does constitute a security hole...". > > > I was not able to find any recent discussion about this topic on this > list (there was one in 2002 [3]). Is there some documentation describing > the shared memory segments accessible by all cygwin users? > > What is the current status of the following security threats and how > would you rate security when running sshd in a multi user environment. > > -Code execution in the context of an other user > -Denial of service by overwriting the shared memory segments > of cygwin > -Data disclosure about processes of an other user by reading > shared memory segments > -Other security issues
We're not aware of security implications, but we don't give any guarantee either and there's no such thing as a security survey for Cygwin. If that's not sufficient for your company, feel free to contact Red Hat for a support contract which could cover are more detailed analysis, http://www.redhat.com/software/cygwin/ Corinna -- Corinna Vinschen Please, send mails regarding Cygwin to Cygwin Project Co-Leader cygwin AT cygwin DOT com Red Hat, Inc. -- Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple Problem reports: http://cygwin.com/problems.html Documentation: http://cygwin.com/docs.html FAQ: http://cygwin.com/faq/
