[PATCH] Error checking for SETXID (bug 13347)

[Mike Frysinger]

On Mon 24 Mar 2014 12:26:32 Rich Felker wrote:
> On Mon, Mar 24, 2014 at 04:57:23PM +0100, Florian Weimer wrote:
> > >I was asking whether there might be a way to setup the
> > >conditions prior to making the setuid syscalls such that if the first
> > >one succeeds, the subsequent ones cannot fail.
> > 
> > Not in general, no, because the kernel implementation calls into the
> > Linux Security Module framework, whose modules typically implement
> > additional preconditions we cannot check in glibc due to
> > insufficient information.
> 
> Yes, I'm well aware of the Linux Insecurity Modules framework. Any
> framework that can make standard functions with documented interface
> contracts violate their own interface contracts subtracts from the
> security of a system rather than adding to it, and I really have no
> problem with telling users this if they're running broken Insecurity
> Modules.
> 
> But back to the topic, I was assuming correct behavior from the
> kernel. If the kernel misbehaves, aborting is a perfectly reasonable
> response (but if LSM's make the kernel lie, can you even tell if it
> misbehaved?).

trying to stack the deck against failure is a good idea, but that is 
orthogonal to checking the return value.  there's no good reason at all to not 
check & abort when the call fails.
-mike
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 836 bytes
Desc: This is a digitally signed message part.
URL: <http://sourceware.org/pipermail/libc-alpha/attachments/20140324/dfed3631/attachment.sig>