From mboxrd@z Thu Jan 1 00:00:00 1970 X-Spam-Checker-Version: SpamAssassin 3.4.4 (2020-01-24) on inbox.vuxu.org X-Spam-Level: X-Spam-Status: No, score=-3.3 required=5.0 tests=MAILING_LIST_MULTI, RCVD_IN_DNSWL_MED,RCVD_IN_MSPIKE_H3,RCVD_IN_MSPIKE_WL autolearn=ham autolearn_force=no version=3.4.4 Received: (qmail 18869 invoked from network); 13 Oct 2020 09:53:10 -0000 Received: from mother.openwall.net (195.42.179.200) by inbox.vuxu.org with ESMTPUTF8; 13 Oct 2020 09:53:10 -0000 Received: (qmail 3859 invoked by uid 550); 13 Oct 2020 09:53:06 -0000 Mailing-List: contact musl-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-ID: Reply-To: musl@lists.openwall.com Received: (qmail 3835 invoked from network); 13 Oct 2020 09:53:05 -0000 From: "Laurent Bercot" To: musl@lists.openwall.com Date: Tue, 13 Oct 2020 09:52:54 +0000 Message-Id: In-Reply-To: <20201013024737.GB7816@voyager> References: <93cbaeffbc860a145843e0380058c50e@ispras.ru> <20201012145549.GG17637@brightrain.aerifal.cx> <20201013024737.GB7816@voyager> User-Agent: eM_Client/8.0.3385.0 Mime-Version: 1.0 Content-Type: text/plain; format=flowed; charset=utf-8 Content-Transfer-Encoding: quoted-printable X-VR-SPAMSTATE: OK X-VR-SPAMSCORE: 0 X-VR-SPAMCAUSE: gggruggvucftvghtrhhoucdtuddrgedujedrheelgddvudcutefuodetggdotffvucfrrhhofhhilhgvmecupfgfoffgtffkveetuefngfdpqfgfvfenuceurghilhhouhhtmecufedttdenucenucfjughrpefhvffufffkjghfrhgfgggtgfesthhqredttderjeenucfhrhhomhepfdfnrghurhgvnhhtuceuvghrtghothdfuceoshhkrgdqughivghtlhhisggtsehskhgrrhhnvghtrdhorhhgqeenucggtffrrghtthgvrhhnpeeuiefhhfeuveegudejgfegudeufeevudeftdelveeifeffiedtieehteehtdevtdenucevlhhushhtvghrufhiiigvpedtnecurfgrrhgrmhepmhhouggvpehsmhhtphhouhht Subject: Re: [musl] Calling setxid() in a vfork()-child >If dropping privileges is all you want, then posix_spawn() has a flag >for that. But it does not. All POSIX_SPAWN_RESETIDS does is make sure that a s-bit program does not spawn a child with the same effective uid as its caller; there is nothing in posix_spawn() about dropping root privileges. This is one of process state change operations that are lacking in posix_spawn(), along with being able to spawn the child as a session leader (despite being able to spawn it as a process group leader). That's what makes exhaustive attribute listing a bad function design: there is always an attribute that designers forget. I understand how useful posix_spawn() is for portable correctness, I use it over fork() whenever I can, but it is definitely not complete without helper programs and it's an ugly wart that nobody benefits from ignoring. -- Laurent