Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.unix.programmer > #878

Re: Why user can change password?

Show all headers | View raw

On Wed, 29 Jun 2011 18:42:04 -0700, Golden California Girls wrote:

> On 6/29/11 7:41 AM, John Gordon wrote:
>> It runs as root, and has permission
>> to do anything root could do (which is everything.)
>> 
> 
> I was under the impression that a program running as root was limited and
> can't do everything.  An example being ignoring a kill, or reading and
> writing any address in any process space.  These are things a driver can do
> as a driver is allowed to run CPU privileged instructions.  Am I wrong and
> a program running as root can run CPU privileged instructions?

User-space programs are still limited by hardware-based protection
mechanisms (user-mode/ring-3/etc versus supervisor-mode/ring-0/etc),
although they may be able to circumvent these mechanisms by
creating and loading kernel modules.

Processes owned by "root" (i.e. UID 0) are special insofar as explicit,
software-based permission checks normally succeed if the UID is 0,
regardless of any other factors which are normally taken into account
(e.g. file permissions or ownership).

Some Unix systems (e.g. *BSD) have a "securelevel" mechanism which
disables any feature which can be used to circumvent the normal security
mechanisms, e.g. loading kernel modules, direct access to memory or I/O
ports, etc. Typically, the securelevel starts at zero (no restriction);
once all kernel modules have been loaded and the hardware has been
initialised, the securelevel is increased. After this point, the security
mechanisms cannot be bypassed even by root, and the securelevel cannot be
decreased (other than by a reboot).

Back to comp.unix.programmer | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

Why user can change password? Mateusz_madi <madi.czadi@gmail.com> - 2011-06-29 02:44 -0700
  Re: Why user can change password? jt@toerring.de (Jens Thoms Toerring) - 2011-06-29 09:55 +0000
  Re: Why user can change password? Ben Finney <ben+unix@benfinney.id.au> - 2011-06-29 22:36 +1000
    Re: Why user can change password? jt@toerring.de (Jens Thoms Toerring) - 2011-06-29 15:03 +0000
  Re: Why user can change password? John Gordon <gordon@panix.com> - 2011-06-29 14:41 +0000
    Re: Why user can change password? Golden California Girls <gldncagrls@aol.com.mil> - 2011-06-29 18:42 -0700
      Re: Why user can change password? Barry Margolin <barmar@alum.mit.edu> - 2011-06-29 22:29 -0400
      Re: Why user can change password? Eric Sosman <esosman@ieee-dot-org.invalid> - 2011-06-29 22:29 -0400
      Re: Why user can change password? gordonb.h6afl@burditt.org (Gordon Burditt) - 2011-06-29 22:10 -0500
      Re: Why user can change password? Nobody <nobody@nowhere.com> - 2011-06-30 18:10 +0100

csiph-web