On Fri, Oct 30, 2026, at 07:32, Stephen J Smoogen wrote: > On Fri, Oct 30, 2026, at 07:19, Florian Weimer via devel wrote: >> * Simon de Vlieger: >> >>> On Wed, Oct 28, 2026, at 6:47 PM, Florian Weimer via devel wrote: >>>> The upstream Rust security team has not documented that Rust is safe to >>>> use in SUID binaries, and the standard library (and therefore most >>>> crates) do not take this special operating environment into >>>> consideration. >>> >>> Aside from the dependencies; do languages for current SUID binaries document >>> that they are safe to use in SUID contexts? Seems like a funky hurdle to >>> impose. :) >> >> It's documented for the C library. Not in glibc manual, but for example >> in Garfinkel and Spafford, Partical UNIX and Internet Security. The >> second edition has an entire chapter, Writing Secure SUID and Network >> Programs. >> > > That edition of the book is also older than many people writing Rust > programs. The third and last edition is from 2003. I don't know what is > in 2nd edition but third edition tips are at > https://archive.org/details/practical_unix_and_internet_security-0596003234/page/516/mode/2up > > > Frankly I put this above "It was on display in the bottom of a locked > filing cabinet stuck in a disused lavatory with a sign on the door > saying 'Beware of the Leopard.'" but not a lot more. Unless there is > something similar in the glibc manual, or similar areas.. how is anyone > in general going to know how to properly deal with suid/sgid or similar > items? >
I forgot a smiley.. and I also don't know if I actually followed my own below advice on this. I do think we need a better documentation of how to do this well for any language since our AI coders will need to follow it. -- Stephen J Smoogen. Let us be kind to one another, for most of us are fighting a hard battle. -- Ian MacClaren -- _______________________________________________ devel mailing list -- [email protected] To unsubscribe send an email to [email protected] Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/[email protected] Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new
