Date: Wed, 27 May 2015 18:15:17 -0700
From: Orion <systmkor@gmail.com>
To: alpine-devel@lists.alpinelinux.org
Subject: Re: [alpine-devel] 3.3 proposal: reduce number of SUID binaries as
 much as possible
Message-ID: <20150527181517.6b9bd422@twinpeaks.my.domain>
In-Reply-To: <5564D539.1050102@exs-elm.ru>
References: <CA+T2pCFTMLEuZjsYCbXVK7GEG3v0S9EvP5FkbboS+mKRK9_0yA@mail.gmail.com>
	<20150526134643.GA1825@newbook>
	<5564D539.1050102@exs-elm.ru>
Precedence: list
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha256;
 boundary="Sig_/cxtyw3IESq88Svg/avayaZy"; protocol="application/pgp-signature"

--Sig_/cxtyw3IESq88Svg/avayaZy
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: quoted-printable

On Tue, 26 May 2015 23:19:05 +0300
eleksir <eleksir@exs-elm.ru> wrote:

> Sure. Let's remove suid from sudo and su. It will be clever joke when=20
> you try to switch to root and fail.

Well with certain roles within a grsec policy that may make sense. :P
For example if you wanted to do some malware sandbox testing.
=20
> Go ahead you security freak, remove all suid bits and patch
> kernel/libc to remove all roots of this suid evil.

https://imgur.com/Hej4ZKh

> C'mon people, stop already this talks about "cleaning" system. Submit=20
> patches, make upstream (not distro maintainers) accept them.

As an end-goal I agree. I think we should try to push these patches back
up-stream to reduce the work distro maintainers need to do. That said
many of these developers don't care about security or they just don't
want to have to change.=20

To help push various packages following the 'principle of least
privilege' we should

1. Build working examples on Alpine
2. Automate or simplify this process
3. Communicate with and push to upstream developers

--=20
keybase.io/systmkor

--Sig_/cxtyw3IESq88Svg/avayaZy
Content-Type: application/pgp-signature
Content-Description: OpenPGP digital signature

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQIcBAEBCAAGBQJVZmwlAAoJEPM7NuFpB6Q+nkcP/RhaZx/eKcV4nB8PRv9UE051
calnT0I5dAkYz7VqiggbojdrX8B0oypjmy1784fO3/XW+9xvZkmlgG52yBcYMDbA
TLIEiKN1YliQAdp6ZVdGpCwxwHv0aRaazXpMQW8XSD938xre+S5T7jqRb2Kt2rAX
ilbUiCDwG7TmkRpoBfxZ9VIbKZwLdztQ2Vkg44BQMZLXEkmELg6kXK0poxul4xm0
i1AUvVOlSuGLJq0wwDZ7j6ct3hnZzJAGDE53hHcMT1caZvm/EhSKHEWmWX0GFWAY
Du58RtwQfmlXthZx22LwiI6L9kFUTXWrt+cBOZ+sS9qLNwEj6sIgcIty24YtycYe
dlGkCDYXmpTXGAwstECOSr45ml11JO42jKi4vxoF6VkjwXUxuUTBRXxzBcC3MR+u
SW36magaK8e9sI5IqYt1mmRO08hBNq+dOQEAJTI8DvYsNljDPlhjnouYTU/iWPt+
Hr70fuWdQqoGTSxbzjn1lrhl8a3FuCAwOOZkyaoiJ+tmztkz61bpol7HyJczLAdY
imjbKbkUYOy9fGVcIfNpqDTaM5WjQ2YkYkCgemyXpDRUWXy4x+rNBKvjie0wMBJr
VC/BWZkkiFYnyI6H5OQcZEsbLFZYAumIvFWPDB3sH4PpE7BrtcE8mUdBbDPUVdk3
Q6/UwnivZJHC2F8M0Ot8
=t342
-----END PGP SIGNATURE-----

--Sig_/cxtyw3IESq88Svg/avayaZy--


---
Unsubscribe:  alpine-devel+unsubscribe@lists.alpinelinux.org
Help:         alpine-devel+help@lists.alpinelinux.org
---