| |||
| bsd | dude, where's my code? | ||
| code | hacking for the masses | ||
| contact | solo sex does not qualify as reaching out and touching someone | ||
| gnu | what it means to be free | ||
| history | what state of mental health? | ||
| microsoft | on the lack of innovation | ||
| mrt | get out of school, do drugs, don't drink milk | ||
| phil | an ode to my favorite groundhog | ||
| religion | i am write and you are wrong | ||
| schismtracker | what makes good software great | ||
| secure | tightrope walking without a net | ||
( home : code : kchuid ... ldapdns ) A new dramatist of the absurd Has a voice that will shortly be heard. I learn from my spies He's about to devise An unprintable three-letter word.
kchuid.tgz ... DOWNLOAD ... README ... CHANGELOG ...
kchuid mailing list ... mailing list archives disabled temporarily....
WHAT IT IS
have you seen that demonstration made by the HURD? logged in as your bad self, you started making extensive changes to /etc/hosts only to discover- you're not root. Woe is you, and now you have to save to a temporary file, exit, su, copy, and etc.
HURD promised you the ability to change the access of a running process! It also promises more, but we don't like to wait, so we gave Linux the same ability.
WHERE IT IS AT
This is a demonstration of something with a great deal of potential. But it is not complete; you cannot yet replace your xdm, xlock, su and login tools. But we're getting there.
You can write your own authentication backend and use it with kchuid. Not developmentally inclined? You can at the very least see a fantastic demonstration involving the change of a processes' uid/gid without being setuid root, and without having to be root in the first place.
WHAT IT IS NOT
I feel compelled to point out this is not an exploit of any problem. You need root access to run the server, and you need root access to install the kernel module. There's no way around that.
It's also not suitable for a production or multiuser machine. In it's default state, you'll happily give away uid/gid 1/1 to any local user who has had the privelege of downloading and reading this code.
WHERE IT IS GOING
well, a replacement for plain.so would be nice; hopefully one that uses the system password database. An LDAP one would be nice as well.
Programs will also have to be patched/modified to use the new login API. The chicken-and-egg problem is strong with this one.
⠄⠵