NVIDIA / NVIDIA/nvidia-modprobe
Alternatives to suid
Nobody has claimed this yet.
- Dominant language
- C
- Stars
- 85
- Forks
- 20
- PR merge metrics
- No merged PRs in 30d
Description
I probably don't need to go into too much detail about the security implications of suid, but in short, setting the suid bit on an executable introduces attack vectors, since the program will run as root regardless of which user executed it. Increasingly, there are non-suid alternatives for the functionality of common suid binaries (e.g. run0 in place of sudo, Polkit switching to a service-based approach for their agent, etc).
As described by @scaronni here, a non-suid approach was tested recently, but was stopped because it was failing in some cases.
Revisiting and fixing a non-suid approach would be beneficial for the security of NVIDIA users on Linux systems.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reviewing the non-suid approach and its reported failures in the linked nvidia-modprobe issue and comment. Determine the affected functionality and failure cases before defining a feasible replacement; done means NVIDIA users can obtain the required device setup without an executable carrying the suid bit.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c, linux
- Domain
- operating-systems, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Quiet
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100