On Fri, 2026-10-30 at 07:32 -0400, Stephen J Smoogen wrote: > > > On Fri, Oct 30, 2026, at 07:19, Florian Weimer via devel wrote: > > * Simon de Vlieger: > > > > > On Wed, Oct 28, 2026, at 6:47 PM, Florian Weimer via devel wrote: > > > > The upstream Rust security team has not documented that Rust is > > > > safe to > > > > use in SUID binaries, and the standard library (and therefore > > > > most > > > > crates) do not take this special operating environment into > > > > consideration. > > > > > > Aside from the dependencies; do languages for current SUID > > > binaries document > > > that they are safe to use in SUID contexts? Seems like a funky > > > hurdle to > > > impose. :) > > > > It's documented for the C library. Not in glibc manual, but for > > example > > in Garfinkel and Spafford, Partical UNIX and Internet Security. > > The > > second edition has an entire chapter, Writing Secure SUID and > > Network > > Programs. > > > > That edition of the book is also older than many people writing Rust > programs. The third and last edition is from 2003. I don't know what > is in 2nd edition but third edition tips are at > https://archive.org/details/practical_unix_and_internet_security-0596003234/page/516/mode/2up > > > Frankly I put this above "It was on display in the bottom of a locked > filing cabinet stuck in a disused lavatory with a sign on the door > saying 'Beware of the Leopard.'" but not a lot more. Unless there is > something similar in the glibc manual, or similar areas.. how is > anyone in general going to know how to properly deal with suid/sgid > or similar items?
It is not like putting this search in duckduckgo: "is there some documentation no how to write safe suid programs in unix ?" came up with zero results ... Best, Simo. -- _______________________________________________ devel mailing list -- [email protected] To unsubscribe send an email to [email protected] Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/[email protected] Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new
