The UNIX process identity crisis: A standards-driven approach to setuid

Proceedings of the ACM Conference on Computer and Communications Security

Volumn , Issue , 2014, Pages 1391-1402

  Dittmer, Mark S ^a   Tripunitara, Mahesh V ^a  

^a UNIVERSITY OF WATERLOO   (Canada)

Author keywords

POSIX; Privilege management; Setuid

Indexed keywords

DATA PRIVACY; SECURITY OF DATA;

CURRENT STATUS; IN-PROCESS; NON-CONFORMANCE; POSIX; POSIX STANDARDS; PRIVILEGE MANAGEMENT; SETUID;

SEMANTICS;

EID: 84910617091     PISSN: 15437221     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1145/2660267.2660333     Document Type: Conference Paper

References (21)

1. dijkstra shortest paths. http://www.boost.org/doc/libs/1-55-0/libs/graph/doc/dijkstra-shortest-paths.html. boostC++ libraries. Last accessed: Aug. 14, 2014.
2. LiCo-The New LinuxCounter Project. http://linuxcounter.net/. Last accessed: Nov. 12, 2013.
3. The Austin Common Standards Revision Group. http://www.opengroup.org/austin/. Last accessed: Aug. 14, 2014.
4. getresgid, getresuid, setresgid, setresuid-get or set real, effective and saved user or group ID. FreeBSD System Calls Manual, Apr. 2001.
5. setresuid, setresgid-set real, effective and saved user or group ID. Linux Programmer's Manual, July 2007.
6. Capabilities-overview of Linux capabilities. Linux Programmer's Manual, Aug. 2009.
7. getresgid, getresuid, setresgid, setresuid-get or set real, effective and saved user or group ID. OpenBSD Programmer's Manual, Aug. 2013.
8. A. N. M. Abdullah, B. Akbarpour, and S. Tahar. Error Analysis and Verification of an IEEE 802.11 OFDM Modem using Theorem Proving. In Proceedings of the First Workshop on Formal Methods for Wireless Systems (FMWS 2008), pages 3-30, 2009.
9. M. Bishop. How to write a setuid program. USENIX ;login:, 12(1), Jan. 1987.
10. M. Bishop. Computer Security-Art and Science. Addison-Wesley, 2003.
11. CERT. POS37-C. Ensure that privilege relinquishment is successful. https://www.securecoding.cert.org/confluence/display/seccode/POS37-C.+Ensure+that+privilege+relinquishment+is+successful, June 2013.
12. H. Chen, D. Wagner, and D. Dean. Setuid Demystified. In Proceedings of the 11th USENIX Security Symposium, pages 171-190, Aug. 2002.
13. D. Dean and A. J. Hu. Fixing Races for Fun and Profit: How to Use access(2). In Proceedings of the 13th USENIX Security Symposium, pages 195-206, Aug. 2004.
14. J. H. Saltzer and M. D. Schroeder. The Protection of Information in Computer Systems. Proceedings of the IEEE, 63(9):1278-1308, September 1975.
15. IEEE and The Open Group. POSIX.1-2008, 2013. Available from http://pubs.opengroup.org/onlinepubs/9699919799/.
16. B. Jain, C.-C. Tsai, J. John, and D. E. Porter. Practical Techniques to Obviate Setuid-to-root Binaries. In Proceedings of the Ninth European Conference on Computer Systems, EuroSys'14, pages 8:1-8:14, New York, NY, USA, 2014. ACM.
17. D. M. Ritchie. Protection of datafile contents. US Patent 4135240, Jan. 1979.
18. M. S. Dittmer and M. V. Tripunitara. unix-process-identity. https://github.com/mdittmer/unix-process-identity, 2014.
19. A. Souari, S. Tahar, and A. Gawanmeh. Formal error analysis and verification of a frequency domain equalizer. In IEEE 10th International New Circuits and Systems Conference (NEWCAS), pages 189-192, 2012.
20. D. Tsafrir, D. D. Silva, and D. Wagner. Change Process Identity. Available from https://code.google.com/p/change-process-identity/. Last accessed May 2014.
21. D. Tsafrir, D. D. Silva, and D. Wagner. The Murky Issue of Changing Process Identity: Revising "Setuid Demystified". USENIX ;login:, 33(3), June 2008.