News for hackers. Stuff that matters.

A comment on Environment Variables Considered Harmful for Your Secrets. Parent comment

Re:Environment Variables Considered Harmful for Your Secrets by geocar on Friday January 02, 2015 @04:27PM (#8828652)
Using a setuid helper (even if it's called sudo) is still starting a program as root.
[ Parent | on HN ]
Re:Environment Variables Considered Harmful for Your Secrets by icebraining on Friday January 02, 2015 @05:33PM (#8828946)
Not necessarily; sudo on Fedora has CAP_SETUID instead of the setuid bit, so it doesn't actually run as root.

http://fedoraproject.org/wiki/Features/RemoveSETUID

[ Parent | on HN ]
Re:Environment Variables Considered Harmful for Your Secrets by ptx on Sunday January 04, 2015 @12:39PM (#8835109)
But CAP_SETUID, unless I'm confusing it with something else, can be used to set the UID to 0 and thereby gain all the same privileges as if the program had been started as root, can't it? Presumably it has some advantage that I'm not getting – does it have to be combined with e.g. SELinux to be useful?
[ Parent | on HN ]