Security impact of nscd and NSS module bugs (particularly NIS)

[Rich Felker]

On Sat, Jul 05, 2014 at 09:05:04AM +0200, Andreas Schwab wrote:
> Rich Felker <dalias@libc.org> writes:
> 
> > Isn't just eliminating the unwanted modules from /etc/nsswitch.conf
> > the natural way to prevent fallback on the client side?
> 
> That will affect nscd as well.

Yes, but adding a new option to suppress loading only on the client
side would fail to suppress it in older glibc versions, including
static-linked ones. That seems like a failure from a security
standpoint. On the other hand, removing the modules in
/etc/nsswitch.conf would protect all clients and nscd could easily be
built to use a different configuration than the one in
/etc/nsswitch.conf.

Personally I would love for this kind of setup to become the default,
since loading nss modules (especially anything custom or not widely
used) into every application is a nightmare from a security
standpoint, not to mention namespace-safety, and of course breaks
static linking.

Rich