On Thursday 14 November 2013 00:50:33 Piotr Grzybowski wrote:
> I can think of an attack, just provide me with ip address of the host
> :) and a root account password and login :)
>
> I agree that most systems have other abilities to do the (almost)
> same, but yet, all systems (that is to say m
On Wednesday 13 November 2013 06:39:45 Irek Szczesniak wrote:
> On Wed, Nov 13, 2013 at 7:35 AM, Piotr Grzybowski wrote:
> > Hi Everyone, hi Joel,
> >
> > the idea is nice, and I can really see that it is useful, but I would
> >
> > be extremely careful with introducing those kind of changes, it
On Thursday 14 November 2013 11:32:18 Cedric Blancher wrote:
> On 13 November 2013 15:46, Joel Martin wrote:
> > On Wed, Nov 13, 2013 at 6:39 AM, Irek Szczesniak wrote:
> >> The other problems I see is:
> >> How can the script get access to the data returned by accept()? Unlike
> >> ksh93 bash4 has
On 13 November 2013 15:46, Joel Martin wrote:
> Irek,
>
> Great feedback. Comments inline.
>
> On Wed, Nov 13, 2013 at 6:39 AM, Irek Szczesniak wrote:
>
>> ':' in *any* Unix paths is not wise because its already used by $PATH.
>> Likewise ';' is already occupied by version file systems.
>>
>
> I
On 14 November 2013 14:20, Andreas Schwab wrote:
> Piotr Grzybowski writes:
>
>> I can think of an attack, just provide me with ip address of the host
>> :) and a root account password and login :)
>
> Why bother with an attack if you are root?
Trusted Unix 'root' or 'root' in Solaris zones is
Piotr Grzybowski writes:
> I can think of an attack, just provide me with ip address of the host
> :) and a root account password and login :)
Why bother with an attack if you are root?
Andreas.
--
Andreas Schwab, SUSE Labs, sch...@suse.de
GPG Key fingerprint = 0196 BAD8 1CE9 1970 F4BE 1748
On Thu, Nov 14, 2013 at 06:50:33AM +0100, Piotr Grzybowski wrote:
> My main point is: this patch means that every user that has access to
> who-knows-how restricted shell can open listen sockets, and unless
> someone thought of using grsecurity to deny access to bind(2) it is
> unrestricted.
Rest
Hullo Joel,
I can think of an attack, just provide me with ip address of the host
:) and a root account password and login :)
I agree that most systems have other abilities to do the (almost)
same, but yet, all systems (that is to say many more than have nc)
have bash, and while roots on those w
Irek,
Great feedback. Comments inline.
On Wed, Nov 13, 2013 at 6:39 AM, Irek Szczesniak wrote:
> ':' in *any* Unix paths is not wise because its already used by $PATH.
> Likewise ';' is already occupied by version file systems.
>
I had considered that issue when I was trying to come up with a
Hi Piotr,
Thanks for the feedback. I don't believe this functionality changes the
attack surface. Most systems with bash also have nc/netcat or an equivalent
program which can do the same thing. Even the nc version in busybox has
listen capability. In fact, if you can create a file with arbitrary
On Wed, Nov 13, 2013 at 7:35 AM, Piotr Grzybowski wrote:
> Hi Everyone, hi Joel,
>
> the idea is nice, and I can really see that it is useful, but I would
> be extremely careful with introducing those kind of changes, it can be
> easily interpreted as "backdoor feature", that is: from security po
Hi Everyone, hi Joel,
the idea is nice, and I can really see that it is useful, but I would
be extremely careful with introducing those kind of changes, it can be
easily interpreted as "backdoor feature", that is: from security point
of view it could be a disaster.
cheers,
pg
On Tue, Nov 12,
12 matches
Mail list logo
