Matthew Kirkwood writes ("Re: Capabilities"):
> > Capabilities don't solve the inability to change which port is bound
> > since cap_net_bind_service is equivalent to root on most machines.
>
> Please explain? If bind has only CNBS and runs as user "named",
> then there is no root equivalence that I can see.
If you can bind to low numbered ports, you can fake credentials for
rsh or rlogin. From there, you can get to root on many machines
without much difficulty. Even if you can't get root, CNBS is still
sufficiently powerful that I wouldn't want bind to keep running with
that capability.
Peter
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/
This archive was generated by hypermail 2b29 : Tue Feb 15 2000 - 21:00:18 EST