4. % whoami

5. % whoami

6. % whoami

7. % whoami

8. % whoami

10. % whatis

11. % whatis

12. % whatis

13. % whatis

15. % about

16. % about

17. % about

18. % about

20. ReadMe

21. ReadMe

22. ReadMe

23. ReadMe

24. ReadMe

58. Now let’s review and
see what happened

61. is better than

62. is better than

63. but was insufficient

64. but was insufficient

65. but was insufficient

66. DAC
The owner can set the access
attributes for his/her
resource. This is called DAC
(Discretionary Access
Control).
This is DAC
% chmod 600 my_diary

68. • DAC can be overridden

69. • DAC can be overridden
• You should set DAC carefully, but
should not over trust it

70. • DAC can be overridden
• You should set DAC carefully, but
should not over trust it
• When is DAC broken?

71. root user
root user is not affected by
DAC. root user is the God (if
your Linux is not “security
enhanced” Linux)

72. setuid
a process invoked by a
program with “setuid root”
attribute will be given root
privilege

73. You might think

74. You might think
• getting rid of root user and setuid
mechanisms , but it does not work

75. You might think
• getting rid of root user and setuid
mechanisms , but it does not work
• there are tasks for root

76. You might think
• getting rid of root user and setuid
mechanisms , but it does not work
• there are tasks for root
• you can change your password because
passwd command is setuid root

77. You might think
• getting rid of root user and setuid
mechanisms , but it does not work
• there are tasks for root
• you can change your password because
passwd command is setuid root
• yes, we do need privileges

95. AI

96. AI

97. AI

115. rm -rf *

123. mount chroot

173. Concept, story, presentation design
Toshiharu Harada (NTT DATA CORPORATION)
Illustration
Yumiko Tatsumoto (NTT DATA CORPORATION) and
Akira Igarashi in association with Studio Padre
Special thanks to
of NTT DATA CORPORATION

174. FreedomHEC 2008 is such a nice conference. I’m very
happy to be here and appreciated the heartfelt supports by
Huang Chao Lung, Mei-Li Chen, other staff and the sponsors.
Hope you keep working and see again soon
Linux

178. This slides available at
http://tomoyo.sourceforge.jp/taipei2008/