Re:CVE-2015-8126: Multiple buffer overflows in libpng
by wbl on Saturday November 14, 2015 @08:50PM
(#10568175)
That's just not true. A program needs to be started root to execute setuid(2): there is no way for a program started by an unprivileged user to drop privileges. Nor can it drop network privileges. That's why tools like pledge(2) and seccomp had to be added, but they have their own problems. To get the level of isolation GP described, you need some fairly esoteric solutions.
[ Parent
| on HN ]
Re:CVE-2015-8126: Multiple buffer overflows in libpng
by ploxiln on Saturday November 14, 2015 @10:59PM
(#10568424)
Well seccomp() strict mode (only allows read, write, exit) has been available since linux-2.6.12 (2005). So no need to invent something new, or set up a bunch of cgroups and namespaces, to get processes that can only read stdin and write stdout and use some of their own memory.