Another way to look at this: if you're typing "setreuid" into your code, you're doing it wrong. Most networked Ruby programs don't need to run with superuser creds in the first place. Factor the need out of your code.
The threat model in this post is a bit dated, too. The EUID is insecure if (paraphrase) "you can execute arbitrary code in the process, because you could just execute setuid()". That's true, but it neglects the fact that if I can run arbitrary code in your process, you're fucked anyways:
* Localhost nobody->root is a speed bump on most Linux deployments.
* If your app works as "nobody", so does an attacker with "nobody" creds.
* "Nobody" has network access, can talk directly to your database, and to every insecure box in your data center.
Comments
Another way to look at this: if you're typing "setreuid" into your code, you're doing it wrong. Most networked Ruby programs don't need to run with superuser creds in the first place. Factor the need out of your code.
The threat model in this post is a bit dated, too. The EUID is insecure if (paraphrase) "you can execute arbitrary code in the process, because you could just execute setuid()". That's true, but it neglects the fact that if I can run arbitrary code in your process, you're fucked anyways:
* Localhost nobody->root is a speed bump on most Linux deployments.
* If your app works as "nobody", so does an attacker with "nobody" creds.
* "Nobody" has network access, can talk directly to your database, and to every insecure box in your data center.