From mboxrd@z Thu Jan 1 00:00:00 1970 X-Msuck: nntp://news.gmane.org/gmane.linux.lib.musl.general/7334 Path: news.gmane.org!not-for-mail From: u-wsnj@aetey.se Newsgroups: gmane.linux.lib.musl.general Subject: [OT] setuid (Re: Busybox on musl is affected by CVE-2015-1817) Date: Fri, 3 Apr 2015 12:31:58 +0200 Message-ID: <20150403103158.GH4456@example.net> References: <20150330053150.GA484@brightrain.aerifal.cx> <20150331234810.GN6817@brightrain.aerifal.cx> <20150401074116.GN23636@example.net> <551BA847.3040609@gmx.de> <20150401084940.GO23636@example.net> <551D4A74.7070102@gmx.de> <20150403002656.11f75341@r2lynx> <20150402183627.GE4456@example.net> <20150403115158.66654b1e@r2lynx> Reply-To: musl@lists.openwall.com NNTP-Posting-Host: plane.gmane.org Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Trace: ger.gmane.org 1428057163 10539 80.91.229.3 (3 Apr 2015 10:32:43 GMT) X-Complaints-To: usenet@ger.gmane.org NNTP-Posting-Date: Fri, 3 Apr 2015 10:32:43 +0000 (UTC) To: musl@lists.openwall.com Original-X-From: musl-return-7347-gllmg-musl=m.gmane.org@lists.openwall.com Fri Apr 03 12:32:43 2015 Return-path: Envelope-to: gllmg-musl@m.gmane.org Original-Received: from mother.openwall.net ([195.42.179.200]) by plane.gmane.org with smtp (Exim 4.69) (envelope-from ) id 1Ydyu2-0005BC-Am for gllmg-musl@m.gmane.org; Fri, 03 Apr 2015 12:32:42 +0200 Original-Received: (qmail 9468 invoked by uid 550); 3 Apr 2015 10:32:39 -0000 Mailing-List: contact musl-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: Original-Received: (qmail 9343 invoked from network); 3 Apr 2015 10:32:32 -0000 X-T2-Spam-Status: No, hits=0.8 required=5.0 tests=BAYES_50 Received-SPF: none receiver=mailfe09.swip.net; client-ip=194.150.168.95; envelope-from=u-wsnj@aetey.se Content-Disposition: inline In-Reply-To: <20150403115158.66654b1e@r2lynx> Xref: news.gmane.org gmane.linux.lib.musl.general:7334 Archived-At: On Fri, Apr 03, 2015 at 11:51:58AM +0700, Рысь wrote: > Unix credentials were always somewhat limited Exactly. Set*id was created to complement the poor authorization means in the kernel (acls limited to three permissions and crippled to exactly three group-like entries with restricted semantics, for implementation efficiency reasons). It (set*id) is a very powerful, general and wide reaching tool intended in contrast for special and varying situations which need specific treatment, that's why it needs extreme skills and care at every use. This does not scale. Rune