Re: privilege elevation in traffic_server

2014-10-06 Thread James Peach
On Oct 6, 2014, at 11:28 AM, Bill Zeng wrote: > Hi James, > > Can you elaborate on the inconsistency problems a little bit more? To my > understanding, traffic_cop runs as root. traffic_manager and traffic_server > run as unprivileged nobody. traffic_cop runs as root, traffic_manager retains pr

Re: privilege elevation in traffic_server

2014-10-06 Thread Bill Zeng
Hi James, Can you elaborate on the inconsistency problems a little bit more? To my understanding, traffic_cop runs as root. traffic_manager and traffic_server run as unprivileged nobody. Thanks. Bill On Mon, Sep 29, 2014 at 10:57 AM, James Peach wrote: > Hi all, > > I've been looking at the w

Re: privilege elevation in traffic_server

2014-09-29 Thread James Peach
On Sep 29, 2014, at 5:42 PM, Alan M. Carroll wrote: > Monday, September 29, 2014, 4:21:02 PM, you wrote: > >>> At some point would be it worthwhile to go through the least privilege >>> exercise on traffic_manager too? For example, I assume that >>> traffic_manager would not need DAC overrid

Re: privilege elevation in traffic_server

2014-09-29 Thread Alan M. Carroll
Monday, September 29, 2014, 4:21:02 PM, you wrote: >> At some point would be it worthwhile to go through the least privilege >> exercise on traffic_manager too? For example, I assume that traffic_manager >> would not need DAC override privilege. > I expect that traffic_manager would retain CAP

Re: privilege elevation in traffic_server

2014-09-29 Thread James Peach
On Sep 29, 2014, at 1:21 PM, Susan Hinrichs wrote: > > On 9/29/2014 12:57 PM, James Peach wrote: >> Hi all, >> >> I've been looking at the way Traffic Server elevated privilege, and it's >> quite inconsistent right now, and it doesn't work correctly in all >> configurations. I am working on

Re: privilege elevation in traffic_server

2014-09-29 Thread Susan Hinrichs
On 9/29/2014 12:57 PM, James Peach wrote: Hi all, I've been looking at the way Traffic Server elevated privilege, and it's quite inconsistent right now, and it doesn't work correctly in all configurations. I am working on making this consistent. Here is the behavior I plan to implement:

privilege elevation in traffic_server

2014-09-29 Thread James Peach
Hi all, I've been looking at the way Traffic Server elevated privilege, and it's quite inconsistent right now, and it doesn't work correctly in all configurations. I am working on making this consistent. Here is the behavior I plan to implement: 1. traffic_manager runs with real root creden