-----BEGIN PGP SIGNED MESSAGE-----
>>>>> "Pekka" == Pekka Savola <[EMAIL PROTECTED]> writes:
Pekka> Have you checked the code in the CVS? It already includes a
Pekka> "droproot" option.
Pekka> Yours is slightly different, though, as it uses
Pekka> (Linux-specific?) capabilities. I'm not sure if it's
Pekka> necessary when we already drop the root privileges.
Yes, they are Linux specific.
We should have a file:
droppriv-FOO.c
and put all relevant instructions there.
Dropping things like the ability to call connect(2) means that an
attacker can't get out again, even if they are non-root.
- --
] "Elmo went to the wrong fundraiser" - The Simpson | firewalls [
] Michael Richardson, Xelerance Corporation, Ottawa, ON |net architect[
] [EMAIL PROTECTED] http://www.sandelman.ottawa.on.ca/mcr/ |device driver[
] panic("Just another Debian GNU/Linux using, kernel hacking, security guy"); [
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.2 (GNU/Linux)
Comment: Finger me for keys
iQCVAwUBQNsDPYqHRg3pndX9AQFj2wP8CCMkwEc/EwgyAKGhXS8IoQzQjmI/pwf7
6ZDZ5+DBnbdHFAgc0qADP5RMFNYn12NwUWavCnz5umbEapPs4SULJupc2GCNjk0F
HCNsN/81AzC23BT1R4Q9FEq+P76RT7UvBtoR0/UY4okq8lFOl0Zn6CLfQkwzSK2F
vd+n0pozSbg=
=vVaN
-----END PGP SIGNATURE-----
-
This is the tcpdump-workers list.
Visit https://lists.sandelman.ca/ to unsubscribe.
