<html><head></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><br><div><div>On Oct 6, 2011, at 10:11 PM, Cameron Simpson wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><span class="Apple-style-span" style="border-collapse: separate; font-family: Menlo; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; font-size: medium; "><span class="Apple-style-span" style="font-family: monospace; ">Hmm. Glyph seemed to be arguing both ways - that everything should be<br>tested as root, and also that root is not special. I have unease over the<br>former and disagreement over the latter.<br></span></span></blockquote><br></div><div>Your reply to Stephen suggests that we are actually in agreement, but just to be clear: I completely understand that root <i>is</i> special in that the environment allows for several behaviors which are not true for a normal user. Which is precisely why it must be tested by a (properly sandboxed) buildbot :).</div><div><br></div><div>It's just not special in the sense that having root on a throwaway VM would allow you to do non-throwaway things. The one thing one must always be careful of, of course, is having your bandwidth chewed up for some nefarious purpose (spam, phishing) but that sort of thing should be caught with other monitoring tools.</div><div><br></div><div>Plus, there are lots of other impediments to getting Python's buildbots to do something nasty. Only people with a commit bit should be able to actually push changes that buildbot will see. So avoiding root is more about avoiding mistakes than avoiding attacks. (After all, if this process isn't completely secure, then neither is the Python that's shipped in various OSes: in which case, game over _everywhere_.)</div><div><br></div><div>Finally, and unfortunately, there are so many privilege escalation exploits in so many different daemons and applications that it's foolish to treat root as too terribly special: unless you're a real hardening expert and you spend a lot of effort keeping up to the second on security patches, the ability to execute completely arbitrary untrusted code as a unprivileged local user on your system can likely be converted with little effort into the ability to execute arbitrary untrusted code as root. Although, ironically, buildbots are often minimally configured and don't run any other services, so maybe these environments are one of the few places where it actually <i>does</i> make a difference :-).</div><div><br></div><div>(Which is precisely why all daemons everywhere should be written in Python. Buffer overflows are dumb, it's 2011 already, come on. Use Twisted.)</div></body></html>