, 2006-01-18
A recently announced weakness in the BSD securelevel system isn't going to be fixed in OpenBSD. While securelevel may have problems, the vendor's security response is unacceptable and doesn't fit with their stated goals.
Expand all |
Post comment
How not to respond to a security advisory
2006-01-25
Michael Favinsky (1 replies)
Michael Favinsky (1 replies)
a. if a filesystem is damaged (hardware failure) you cannot take it out of service for repair/replacement without rebooting.
b. you cannot reliably restart daemons (file system failure, changed security level since daemon startup.
c. forced frequent reboots - not a good thing on large servers.
As far as coarse control - it still doesn't prevent a root user from rebooting the system to take it over during the restart.
You need enforcable, fine grained, capability lists to do that.
[ reply ]
Link to this comment: http://www.securityfocus.com/comments/columns/380/32975#32975