Oops, sent only to Crispin. Sorry about that. On Fri, 13 Jul 2001, Crispin Cowan spewed into the ether: > As I understand Shane's original request, it is to get away from the > UNIX all-or-nothing "root" security model, without totally throwing away > UNIX. Seth is correct that pure capability-based OS's like KeyOS and > EROS don't have this problem, but that is not the only way to solve this > problem. Ok. How about starting simplifying life first? Other than history, is there *any* reason to allow the first 1024 ports bindable only by root? Since malicious users can now have root access to their own systems, the rationale for restricting the lower ports to be accessible only to root is no longer valid. Remove that restriction and a whole lot of things become simpler. In this case, each program has its own space, its own user and its own privileges. Instead of trying to lock something down and dropping privileges, the whole mess is removed at one stroke. Devdas Bhagat -- Your mode of life will be changed for the better because of new developments. _______________________________________________ linux-security-module mailing list linux-security-moduleat_private http://mail.wirex.com/mailman/listinfo/linux-security-module
This archive was generated by hypermail 2b30 : Sat Jul 14 2001 - 00:17:29 PDT