On Fri, Oct 30, 2026, at 07:19, Florian Weimer via devel wrote: > * Simon de Vlieger: > >> On Wed, Oct 28, 2026, at 6:47 PM, Florian Weimer via devel wrote: >>> The upstream Rust security team has not documented that Rust is safe to >>> use in SUID binaries, and the standard library (and therefore most >>> crates) do not take this special operating environment into >>> consideration. >> >> Aside from the dependencies; do languages for current SUID binaries document >> that they are safe to use in SUID contexts? Seems like a funky hurdle to >> impose. :) > > It's documented for the C library. Not in glibc manual, but for example > in Garfinkel and Spafford, Partical UNIX and Internet Security. The > second edition has an entire chapter, Writing Secure SUID and Network > Programs. >
That edition of the book is also older than many people writing Rust programs. The third and last edition is from 2003. I don't know what is in 2nd edition but third edition tips are at https://archive.org/details/practical_unix_and_internet_security-0596003234/page/516/mode/2up Frankly I put this above "It was on display in the bottom of a locked filing cabinet stuck in a disused lavatory with a sign on the door saying 'Beware of the Leopard.'" but not a lot more. Unless there is something similar in the glibc manual, or similar areas.. how is anyone in general going to know how to properly deal with suid/sgid or similar items? > Thanks, > Florian > > -- > _______________________________________________ > devel mailing list -- [email protected] > To unsubscribe send an email to [email protected] > Fedora Code of Conduct: > https://docs.fedoraproject.org/en-US/project/code-of-conduct/ > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines > List Archives: > https://lists.fedoraproject.org/archives/list/[email protected] > Do not reply to spam, report it: > https://forge.fedoraproject.org/infra/tickets/issues/new -- Stephen J Smoogen. Let us be kind to one another, for most of us are fighting a hard battle. -- Ian MacClaren -- _______________________________________________ devel mailing list -- [email protected] To unsubscribe send an email to [email protected] Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/[email protected] Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new
