Re: Wiping out setuid programs

[avalon () COOMBS ANU EDU AU (Darren Reed)]

In some mail from D. J. Bernstein, sie said:
> This is a continuation of the ``Why you should avoid world-writable
> directories'' thread.
>
> Why do we create setuid programs? Because we need to let users access
> particular files in restricted ways. Some traditional examples:
[...]
> In every case the file access could be moved to a non-setuid daemon that
> accepts UNIX-domain connections from unprivileged user programs. This
> would wipe out a huge number of local security holes.
>
> However, in most cases, the daemon needs to know who it's talking to,
> for access control or for accounting. That's why I want a getpeeruid()
> routine returning the uid that called connect().
[...]
> Anyway, I've set up a web page discussing various IPC mechanisms from
> the writing-daemons-that-manage-restricted-files point of view:
>
>    http://pobox.com/~djb/docs/secureipc.html
>
> Please let me know if you have any updates.

Some of the free unix teams already have designs on how to remove setuid
and setgid from executables using `this' feature.

As with all work done in this community, progress is regulated by people's
available time and other projects in progress - which I'm sure you can
understand.  Given that it originated in the commercial sector (BSDI) (I
believe), it is reasonable to suspeect they've made some progress on this
front also.

Darren