The design is faulty, or at least the design that states the process runs at such a high privelige level that this sort of thing is possible. There is no need for any application to have direct full access to the system.

When I thought I needed Apache on Unix to run as root, I have to jump through hoops. IIRC, I had to patch the source of the server to stop it refusing to run as root.

An application on a server should be able to access what it needs to access, and no more. This is easiest achieved by running it with restricted user permssions and let a known good authorisation scheme (ACLs on files and folders) allow or deny access, instead of trusting the application.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/285/29664#29664