From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (qmail 12293 invoked by alias); 26 Jul 2014 13:29:40 -0000 Mailing-List: contact cygwin-help@cygwin.com; run by ezmlm Precedence: bulk List-Id: List-Subscribe: List-Archive: List-Post: List-Help: , Sender: cygwin-owner@cygwin.com Mail-Followup-To: cygwin@cygwin.com Received: (qmail 12279 invoked by uid 89); 26 Jul 2014 13:29:39 -0000 Authentication-Results: sourceware.org; auth=none X-Virus-Found: No X-Spam-SWARE-Status: No, score=-1.5 required=5.0 tests=AWL,BAYES_00,RCVD_IN_DNSWL_LOW,RP_MATCHES_RCVD,SPF_HELO_PASS,SPF_PASS autolearn=ham version=3.3.2 X-HELO: plane.gmane.org Received: from plane.gmane.org (HELO plane.gmane.org) (80.91.229.3) by sourceware.org (qpsmtpd/0.93/v0.84-503-g423c35a) with (AES256-SHA encrypted) ESMTPS; Sat, 26 Jul 2014 13:29:37 +0000 Received: from list by plane.gmane.org with local (Exim 4.69) (envelope-from ) id 1XB22W-00032P-JO for cygwin@cygwin.com; Sat, 26 Jul 2014 15:29:32 +0200 Received: from boland.xs4all.nl ([213.84.69.3]) by main.gmane.org with esmtp (Gmexim 0.1 (Debian)) id 1AlnuQ-0007hv-00 for ; Sat, 26 Jul 2014 15:29:32 +0200 Received: from daniel by boland.xs4all.nl with local (Gmexim 0.1 (Debian)) id 1AlnuQ-0007hv-00 for ; Sat, 26 Jul 2014 15:29:32 +0200 To: cygwin@cygwin.com From: "D. Boland" Subject: Re: The deprecated uid issue: use caps Date: Sat, 26 Jul 2014 13:29:00 -0000 Message-ID: <53D3AE3F.16D5F95C@boland.nl> References: <53CF6CEC.6D68E485@boland.nl> <53CF7012.2070608@tlinx.org> <53CF749A.1315B799@boland.nl> <53D30D67.2070209@tlinx.org> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit X-IsSubscribed: yes X-SW-Source: 2014-07/txt/msg00320.txt.bz2 Hi Linda, Linda Walsh wrote: > > D. Boland wrote: > > Linda Walsh wrote: > >> D. Boland wrote: > >>> But I had to compromise in some critical areas. One of them is the uid issue. > >>> > >>> * sendmail, procmail, mail.local assume that the id of the privileged user is '0'. > >>> > >>> Isn't it about time to make this our First Directive also? > >>> > >>> > >> I thought sendmail used capabilities? > >> > >> Isn't it about time none of them used a fixed 'uid', but used capabilities? > >> > >> I thought hard coding a Uid was going out with the dodo bird? > > > > You didn't get the point. We create a kernel on which Linux software runs. We don't > > dictate how software should be written. > You are missing the point. > > MS privilege model is the MS version of the linux capability model. > > MS didn't get it wrong, linux has been slow to adopt, but MS had linux > capabilities 10 years before linux did. > > Several other people have tried to explain that the way to go is to use > the "minimum priviledge model". > > For example, almost ALL user have the "unreadable directory traversal" > priv/capability. > > To enforce it cost alot in execution time on Windows (as it would under > cygwin). > > Another priviledge is to "impersonate" another user; sendmail would > likely need such a privilege. Another is to ignore file-permissions. > It would be questionable whether or not sendmail needed that. > > Sendmail was using capabilities back in 2000 when I brought a basic > "non-reciprocal action" bug in the capability code to the attention > of Ted Tso, he told me and others that I didn't know what I was talking > about and they were following POSIX and my "find" was irrelevant under > POSIX. > About 10 days later there was a day-zero exploit involving the bug > in the defective code using sendmail's capability usage as the vector. > The result was kernel caps being disabled for the next few years until > the cap-code could be reviewed by more eyes and knew what to look for. > > So I'm pretty sure sendmail has had code to extensively run solely off > of capabilities and has had it for some time. I'd be surprised if it > was removed. > > Linux software that uses the capability model is likely to not have > these problems. But saying that any random linux software with security > bugs > from the past should work on cygwin, seems like a ridiculous stance to > take. > > You can set capabilities on files processes and network sockets. Linux file > systems with "extended attributes" or "alternate data forks" (2 names > for the > same thing), can and do support "SETCAP" on linux files that works just > like SETUID, but for capabilities. > > MS only supports the capability model and uses it to implement their > Admin or privileged user model. They don't support the less secure setuid > model that linux is moving away from. > > Does this help clarify the issue ? Thanks for disagreeing. You are completely right. Sendmail seems to demand a much more restrictive impersonation policy than Windows offers. That's why I can't get the thing to work. It constantly tests if certain actions are allowed and if so, it just refuses to deliver e-mail. I'll look into this capabilities thing, but I do not intend to change anything significant in the Sendmail code. Maybe the folks at Proofpoint will switch to it one day. Daniel -- Problem reports: http://cygwin.com/problems.html FAQ: http://cygwin.com/faq/ Documentation: http://cygwin.com/docs.html Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple