oss-sec mailing list archives
Re: Running Java across a privilege boundry
From: Russ Allbery <eagle () eyrie org>
Date: Sat, 22 Nov 2014 11:36:58 -0800
Marc Chadwick <marc () chadwick net> writes:
I thought tomcat 6 used authbind in its init script, but I could be wrong. If that's the case, authbind is written in C, so I'm not sure that's what Tim has in mind. Similarly, jsvc is written in C. Maybe the tabuki wrapper service?
Ah, I see what you're getting at. I don't think I've ever used authbind with Tomcat (no need -- I never use privileged ports with it), but (since I use Debian) it gets spawned through start-stop-daemon, which is also written in C. You're saying that the running of the Java program has to be done *directly* by sudo for some reason? The initial question was a little obscure to me. I'm not sure what security problem the original poster is worried about. Starting Tomcat via sudo with that init script is indeed crossing a privilege boundary to run a Java program, but there are several layers of indirection there. Anyway, I have certainly worked with systems with command-line utilities written directly in Java that are run via sudo or other similar tools. The one that comes to mind (Zimbra) isn't open source, but I'm sure there are plenty of others. -- Russ Allbery (eagle () eyrie org) <http://www.eyrie.org/~eagle/>
Current thread:
- Running Java across a privilege boundry Tim Brown (Nov 22)
- Re: Running Java across a privilege boundry Russ Allbery (Nov 22)
- Re: Running Java across a privilege boundry Marc Chadwick (Nov 22)
- Re: Running Java across a privilege boundry Russ Allbery (Nov 22)
- Re: Running Java across a privilege boundry Tim Brown (Nov 22)
- Re: Running Java across a privilege boundry Solar Designer (Nov 23)
- Re: Running Java across a privilege boundry Solar Designer (Nov 25)
- Re: Running Java across a privilege boundry Solar Designer (Dec 08)
- Re: Running Java across a privilege boundry Tim Brown (Dec 18)
- Re: Running Java across a privilege boundry Jakub Wilk (Dec 18)
- Re: Running Java across a privilege boundry Martin Carpenter (Dec 18)
- Re: Running Java across a privilege boundry Jakub Wilk (Dec 18)
- Re: Running Java across a privilege boundry Martin Carpenter (Dec 18)
- Re: Running Java across a privilege boundry Alexander Cherepanov (Dec 18)
- Re: Running Java across a privilege boundry Marc Chadwick (Nov 22)
- Re: Running Java across a privilege boundry Russ Allbery (Nov 22)