Privelege separation

[Renaud Deraison]

On Tue, Aug 24, 2004 at 04:46:11PM -0500, eric wrote:
> > If the OpenSSL client code is vulnerable to some "reverse attack", the
> > bad guy could take control of the nessusd server. Whether he is root or
> > not does not matter: he can nuke your whole network. Privsep won't
> > help. 
> 
> So you're saying that role permissions in nessus do not actually
> work?

He's saying that if an attacker managed to execute arbitrary code 
within the nessusd process, then he would be able to nuke the ACLs
from memory and scan the whole network. He could also do an execl()
of whatever command he wants, there's no reliable mecanism to 
prevent that.  
(otherwise there would not be any need for tools like Nessus in the
first place) [and such mecanisms should be in the OS space first, 
ie: PaX, W^X or whatever]

> > So what? You want to do it for Nessus? Submit a patch and stop pissing
> > me off. This is _free_ and _open_ software. You are allowed to code,
> > to test, to suggest new ideas, not to insult me.
> 
> Indeed I am, and I'm working on some stuff to get at least the
> listener privsep'ed.

Separating the privileges of anything else won't buy you anything,
because the plugins need the ability to execute local commands
(ie: nmap) as root. 

				-- Renaud