multi user environment security due shared memory

[andrea]

Hi all,

Our company is looking at some security properties of cygwin. We want to 
run a daemon like sshd in a multi user environment with cygrunsrv.

There was an entry [0] in your FAQ from 2000/09/13 that cygwin is not 
secure in a multi user environment. This entry was replaced this year 
[1], that as of 1.5.13 you are not aware of any feature to gain more 
privileges than you have under Windows. For my understanding is this 
newest FAQ entry in contrast to what you write in your user guide [2] 
about the use of shared memory in your 'kernel'. There you write
"...it does constitute a security hole...".


I was not able to find any recent discussion about this topic on this 
list (there was one in 2002 [3]). Is there some documentation describing 
the shared memory segments accessible by all cygwin users?

What is the current status of the following security threats and how 
would you rate security when running sshd in a multi user environment.

  -Code execution in the context of an other user
  -Denial of service by overwriting the shared memory segments
   of cygwin
  -Data disclosure about processes of an other user by reading
   shared memory segments
  -Other security issues

Thanks for your help
andrea

[0] cvs rev 1.1 of winsup/doc/how-api.texinfo
[1] http://cygwin.com/faq/faq.api.html#faq.api.secure
[2] http://cygwin.com/cygwin-ug-net/highlights.html#ov-hi-perm
[3] http://www.cygwin.com/ml/cygwin/2002-12/msg01457.html

--
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple
Problem reports:       http://cygwin.com/problems.html
Documentation:         http://cygwin.com/docs.html
FAQ:                   http://cygwin.com/faq/