> On 2008-05-03, Nico Kadel-Garcia <nka...@gmail.com> wrote:
>> This is the philosophy of some programmers. It is a major tactical error. I
>> cannot overstate this. By granting a user non-chrooted shell access, they can
>> do severe and random destrunction to the target system: The partitions
>> containing /tmp, /usr/tmp, and /var/tmp can be overflowed and cause damage
>> that is very difficult to control. They can poke around in any system file
>> that is not secured from non-root access, such as /etc/passwd, for the
>> grabbing of login names and charactistics. They can poke around in any
>> user-accessible shared files. If you run autofs, they can poke karound in
>> *other* system's SSH shared repositories.

>> sftp is fine for protecting the passwords of the user, but it is a nightmare
>> about providing undesirable access to the rest of hte operating system. I've
>> been harsh about this for years.

> Perhaps the strategic equivalent of the above tactical error is that
> a process has authority derived almost entirely from who it runs as
> instead of from a definition of what it is supposed to be doing.

> Ivan's excellent foreword addresses this:
>     http://wiki.laptop.org/go/OLPC_Bitfrost#Foreword

> Other relevant links from David Wagner:
>     http://www.youtube.com/watch?v=EGX2I31OhBE
>     http://www.cs.berkeley.edu/~daw/talks/TRUST07.pdf

> I could rustle up a few more links but the implication
> for ssh/sftp and most other software is that you have to work
> a great deal harder than you should to get reasonable security
> and even then it's usually not all that solid.

> There's a mailing list about this problem and the potential
> of capability-based designs to deal with it at:
>     http://www.eros-os.com/pipermail/cap-talk/