News for hackers. Stuff that matters.

A comment on German BSI withholds Truecrypt security report. Parent comment

Re:German BSI withholds Truecrypt security report by saagarjha on Monday December 16, 2019 @05:47PM (#21808310)
How do you suggest implementing passwd without setuid?
[ Parent | on HN ]
Re:German BSI withholds Truecrypt security report by JdeBP on Tuesday December 17, 2019 @10:17AM (#21814267)
Using the design of the LSASS is one way, as mentioned. Others include OpenWall's tcb, and Daniel Rench's userdirs.

* https://www.openwall.com/tcb/

* https://web.archive.org/web/20030919191907/http://dren.ch:80...

[ Parent | on HN ]
Re:German BSI withholds Truecrypt security report by mehrdadn on Monday December 16, 2019 @05:50PM (#21808353)
Off the top of my head? Ask a system service that has the privilege to change it for you after authenticating you.
[ Parent | on HN ]
Re:German BSI withholds Truecrypt security report by saagarjha on Monday December 16, 2019 @05:54PM (#21808403)
Isn’t that exactly what passwd is? A system service that has permission to change the passwords file?
[ Parent | on HN ]
Re:German BSI withholds Truecrypt security report by mehrdadn on Monday December 16, 2019 @05:58PM (#21808443)
No, the point is that passwd should obtain its privilege by virtue of being started by a privileged process, not by virtue of being marked as a privileged program when it's run by an unprivileged user.
[ Parent | on HN ]
Re:German BSI withholds Truecrypt security report by saagarjha on Monday December 16, 2019 @06:49PM (#21808891)
How do you start the privileged process as a normal user?
[ Parent | on HN ]
Re:German BSI withholds Truecrypt security report by mehrdadn on Monday December 16, 2019 @06:52PM (#21808913)
You don't. It's already started as part of the system. Or you ask some part of the system that is willing to authenticate you to do it for you.
[ Parent | on HN ]
Re:German BSI withholds Truecrypt security report by exikyut on Monday December 16, 2019 @10:03PM (#21810125)
Shhhhhhhhhh.

Stop giving systemd more ideas.

(/s)

(But seriously, imagine a world where you can't get root because D-Bus crashed.)

[ Parent | on HN ]
Re:German BSI withholds Truecrypt security report by ATsch on Tuesday December 17, 2019 @06:01AM (#21812453)
PolicyKit essentially already does this, and all of the systemd *ctl commands support authentication via polkit
[ Parent | on HN ]
Re:German BSI withholds Truecrypt security report by exikyut on Tuesday December 17, 2019 @08:25PM (#21820907)
TIL (so that's what the whole PolicyKit thing was all about).

Now I'm wondering what its worst case crash behavior is like.

[ Parent | on HN ]