Again and again.... Root, who can do everything, he is not a problem. Dumb sysadmin who have it's privileges it's a problem - not root user itself. You MUST have such user in system to do alot of job often violating common policies... Securelevels always were a question of taste, no more. System kernel can be buggy ITSELF(like Linux) or not(like xBSD) - and do you need it to treat iss callbacks in some way of restrictions - it's YOUR task, to use it or not. If you're running self-sanity-checking code, you don't need SecureLevels at all - the system is good by default. If you're running buggy code on a production server and trying to "turn on extra security" via SecureLevels - go home, take a beer and RTFM. IMHO, just IMHO.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/380/33014#33014