Mailing-List: contact cygwin-developers-help AT sourceware DOT cygnus DOT com; run by ezmlm
List-Subscribe: <mailto:cygwin-developers-subscribe AT sources DOT redhat DOT com>
List-Archive: <http://sources.redhat.com/ml/cygwin-developers/>
List-Post: <mailto:cygwin-developers AT sources DOT redhat DOT com>
List-Help: <mailto:cygwin-developers-help AT sources DOT redhat DOT com>, <http://sources.redhat.com/ml/#faqs>
Sender: cygwin-developers-owner AT sources DOT redhat DOT com
Delivered-To: mailing list cygwin-developers AT sources DOT redhat DOT com
Message-ID: <00bc01c0c854$86049830$0200a8c0@lifelesswks>
From: "Robert Collins" <robert DOT collins AT itdomain DOT com DOT au>
To: "egor duda" <cygwin-developers AT cygwin DOT com>
References: <EA18B9FA0FE4194AA2B4CDB91F73C0EF79C2 AT itdomain002 DOT itdomain DOT net DOT au> <20010418120530 DOT Q15962 AT cygbert DOT vinschen DOT de> <00a401c0c7f0$02bb1f30$0200a8c0 AT lifelesswks> <13327115627 DOT 20010418144700 AT logos-m DOT ru> <20010418155552 DOT S15962 AT cygbert DOT vinschen DOT de> <175340295909 DOT 20010418182640 AT logos-m DOT ru> <20010418164712 DOT J15005 AT cygbert DOT vinschen DOT de> <53342543912 DOT 20010418190408 AT logos-m DOT ru> <20010418173712 DOT N15005 AT cygbert DOT vinschen DOT de> <107348915634 DOT 20010418205020 AT logos-m DOT ru> <20010418202943 DOT O15005 AT cygbert DOT vinschen DOT de> <107356516774 DOT 20010418225701 AT logos-m DOT ru>
Subject: Re: handle protection - please comment
Date: Thu, 19 Apr 2001 08:11:30 +1000
MIME-Version: 1.0
Content-Type: text/plain;
	charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 5.50.4133.2400
X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4133.2400
X-OriginalArrivalTime: 18 Apr 2001 22:04:02.0170 (UTC) FILETIME=[7A0A25A0:01C0C853]

----- Original Message -----
From: "egor duda" <deo AT logos-m DOT ru>
To: "Corinna Vinschen" <cygwin-developers AT cygwin DOT com>
Sent: Thursday, April 19, 2001 4:57 AM
Subject: Re: handle protection - please comment


> Hi!
>
> Wednesday, 18 April, 2001 Corinna Vinschen vinschen AT redhat DOT com wrote:
>
> >> now look what /tmp/secret contains.
>
> CV> I didn't test it but I assume it contains "Kaboom!". Hmm. I'm
somewhat
> CV> distressed about that result. So the secure way to get a handle to
any
> CV> shared object is by accessing it using names as suggested by
Robert.
> CV> This doesn't apply to parent/child relations, obviously.
>
> yes. or via trusted server process running under administrator
> account. i suppose PSTORES.EXE (MS' "Protected storage service" is
> used for somthing like this).

Hmm.. could we use pstores?

> RC>> The thing egor as talking about was child process's needing to
read the
> RC>> parents open handles, and that programs than setuid are
apparently
> RC>> setting the perms to everyone, all to allow the child process
with it's
> RC>> different uid to read the handles. He was proposing a server
model,
>
> CV> Wouldn't that problem (which originally was related to ttys) be
resolved
> CV> if the master cares for the duplication?
>
> but slave may also care to not allow master to get into its address
> space or read/write its files. yeah, it's slave, but that doesn't mean
> it have no natural human (err, i mean process :-) ) rights.

Well actually :}As the parent can't launch a process in a higher context
that it is in..?

Hmm, but what about setuid applications, a hacked bash for instance
could launch ssh on the users request, and then get nasty...

I think it matchs the unix model though - runner beware.

>
> Egor.            mailto:deo AT logos-m DOT ru ICQ 5165414 FidoNet
2:5020/496.19
>
>
>