Are there any restriction preventing you from using Demon to build Manse?

One of my players wants to use a Demon he intends to summon to build him a Manse.

Looking at the rules this seems to be within the scope of a demon contract. Core Rule Book p.473

Alternatively, she may assign it to complete a specific task—“Construct a tower using these plans,” “Murder Magistrate Yang,” “Dig a tunnel through this wall”—for as long as it takes to complete. Task-bound demons form a Defining Principle of “I must complete my task,” which is similarly impervious to tampering.

The core of the question I have is how can this be handled? But that question could be broken into a few subparts. Are there any rules that would apply to this situation, and what are they? Also looking for practical experience of how this has been handled by others, and how to avoid the player being able to build castle after castle just using demons as "free" labour. Prefer the suggestions of how to handle it to be linked to rules for 3rd edition.

It would be a bonus if the answer would adress if this would be different if the player "only" wanted to build a mundane tower.

What bonus would be balanced against a restriction on a changeling powers?

I am playing as a changeling in a new campaign where every officially published races are accepted. We told the DM the races and classes we wanted to play in advance and he was OK with it. However, during the first session, he said that my changeling will only be able to change their appearance once per day, during a long rest.

I am going to try to negotiate a bonus in exchange for this restriction.
There are two options I’d like to propose, but don’t know which one would be fair :

  1. The actor feat – So even if my character can’t change very often, they are very good at it.

  2. Unsettling visage, from the UA version of the changeling – It’s in theme and could be fun to describe.

I like "Actor" more, but would it be balanced to get it at first level?

(Please tell me if there are any mistake, English isn’t my first language)

A question about cleric’s alignement restriction on spells

A Cleric can only cast spells of the same alignment to his own or his deity’s.

What happens when a character multiclasses into another spellcasting class? Does the Cleric’s alignment restriction extends to those spells learned with an arcane casting class?

For example: Is it possible for a wizard to cast a spell with the Chaotic descriptor if he/she has multiclassed into a cleric whose deity is lawfully aligned?

Is there a good reason (and what can it be) to require DAC restriction on IPC in addition to SELinux rules?

Our company is developing an AOSP-based platform for our customer. Some of our vendor services are using HWBinder for IPC which is using SELinux to restrict service discovery and access. The problem is that our customer insists that SELinux restriction is not enough and we need to provide a DAC-based restriction as well.

Our customer is basing this requirement on a security audit that was conducted on an earlier version of the platform. This security audit, however, didn’t evaluate HWBinder IPC, but a socket-based IPC that was used in older services. The issue that was highlighted during this audit is that Unix sockets had 0666 access and a recommendation was to change it to 0660 and use Unix groups to allow only specific services to access the socket.

For some reason our customer is now requiring to apply the same (or similar) approach to HWBinder IPC which, however, doesn’t have anything to attach these permissions to.

Unfortunately so far I couldn’t get a straight answer regarding their threat model, so my question is: Does it even make sense to require DAC + SELinux and if so, what threat model should I be considering to properly implement this restriction?

Also, any ideas regarding how I can get our customer an additional layer of security without changing the IPC method would be greatly appreciated.

Major security and usability flaw in Linux (root privileges and sudoers, folder access restriction, Ubuntu Linux)

Alright, let me give you the context. I am a business owner with strong technical background, say a programmer, though not an advanced system administrator. I’ve bought a VPS server where I want to host several applications and webpages. One of the apps consists of backend, admin frontend and user frontend, another one is just backend and frontend. So 5 different programmers develop those apps. From time to time, as the development takes its place, those programmers need to install and upgrade some packages, modify system configs and so on, i.e. they need ssh access and some root privileges.

And here is the tricky part. It is obvious that I don’t want them to see and gain access to the folders they are not supposed to see, i.e. the devs of the first app shouldn’t have access to the folders of the second app and vice versa. Moreover the backend dev of the first app shouldn’t have access to the frontend folders of the same app and the same goes for the second app. Also I would like to restrict access for them to certain commands like visudo or reboot, so they wouldn’t be able to lock me out of my own server or reboot it without my consent.

Now, if I give them sudo privileges for them to be able to run administrative tasks needed for their development – then they have access to everything and it becomes practically impossible to restrict access for them to certain folders and commands. On the other hand if I DON’T give them sudo privileges, then it becomes a huge pain for me to every time install packages and give them access to certain files and commands they need to continue development. There are over 1500 commands and the corresponding number of system files in Linux they could potentially need access to, so it’s very VERY unconvenient for me to spend so much time to administer the VPS, especially getting the fact that I’m not a very advanced system administrator and I don’t have much time because I need to run my business.

There are already numerous posts and threads on the Internet where people try to find solutions to somewhat close problems like these: One, Two, Three, Four, Five, Six, Seven, Eight, Nine, and they still have no reasonable solutions to them, only those that involve some supercomplex activities and anyway not giving a needed result.

So from my point of view as a business owner it should be something like this: there is a root user who can do everything. He can create admins and define access rights for them, for example in that very sudoers file. Then it’s his decision whether to give access to an admin to the sudoers file itself and any of the folders and commands of his choice. For example an admin could be able to run any command in the system except “reboot” and “visudo” and he can access all files and folders except /etc/sudoers and say /var/www/private_folder even WITH sudo privileges invoked (meaning he can’t even copy those files, overwrite them, chmod and chown them and so on, i.e. access them with any command).

That would immediately make the whole system administration A LOT more easier and logical, eliminating the need for complex solutions like chroot jails, separate bash environments, splitting servers into virtual machines, using containers and so on. And it’s so simple, a matter of a couple of conditions in the code, if I understand it correctly from a developer’s perspective. Also, I want to be in control of my VPS, not having to trust any other third person believing he/she won’t steal my information and/or destroy my whole system either by making a mistake or intentionally and basically it can be considered as a serious security vulnerability from a certain point of view.

This seems so obvious and logical for me, that I was really discouraged and embarrassed that it’s really isn’t like that in Linux. Maybe 20 years ago when Linux was created it was enough to have only a root and sudoers and the rest of users to accomplish tasks they had at that time, but today everything goes a bit different way already and that archaic approach is not usable anymore.

Of course I realize I can understand something wrong and there is a strong reason why it has to be as it is, then please let me know why is it so and what is a correct and easy way of solving my problem described above without a need to build a behemoth on my VPS or manually administering it all the time by myself. After all it should be user-friendly, right? Now it’s not.

On the other hand if there is no such a solution, then I would really be willing to even pay someone who could implement some kind of a patch or a package that will allow to solve this problem.

Restriction: polynomial time decision of instance is why needed to “decision Problem”?

I am reading book “combinatorial optimization 3rd edition(Bernhard Korte、 Jens Vygen)”.

(latest version is sixth.)

There are some discriptions in this book that I don’t understand

Not all binary strings are instances of Hamiltonian Circuit but only those representing an undirected graph. For most interesting decision problems the in- stances are a proper subset of the 0-1-strings. We require that we can decide in polynomial time whether an arbitrary string is an instance or not:

  • quote from p350

decision problem is pair P = (X,Y), where X is a language decidable in polynomial time.

  • quote p351

Why decision problem required that decide in polynomial time whether an arbitrary string is an instance or not?

I can’t found any reasons of this restriction in the book.

What is the most damage you can deal reliably and repeatedly without restriction?

I’m wondering how much damage a PC can deal reliably and repeatedly. Another way to phrase this is “what is the maximum damage a PC can always deal?”

Constraints:

  • All content must be “official”: No Unearthed Arcana, Twitter/Stream classes, or homebrew.
  • Assume neutral conditions: No winds or environmental effects, the enemy has no resistances or vulnerabilities unless a feature says otherwise (such as the Grave Cleric’s Path to the Grave feature).
  • To avoid extensive issues, assume the target is a creature that neither benefits not hinders your procedure (for example: a construct is immune to some spells, if using those spells you may assume your target it not a construct)
  • No RNG / chance based results (such as Wild Magic Surges or chaos bolt); similarly, assume you do not crit unless a feature says otherwise (such as the Rogue’s Assassinate feature).
  • No limitations on the procedure: No surprise requirements, rest requirements, spell slot requirements, ki-point requirements, or anything similar unless you have a way to get around them.
  • No help from other characters, this should be doable with only yourself.
  • No magic items, or any items, even weapons and foci / component pouches. (Summoned items such as Pact of the Blade are a-okay so long as you start every turn without them)
  • You may assume your character is being affected by zero conditions (it doesn’t need to be that reliable).
  • You may assume any attack roll hits and any saving throw is failed and all damage dice are minimized (you roll only 1’s).
  • This damage is measured on a per turn basis. You must be able to deal this damage every turn.

What would the balance implications be of removing the spell school restriction of learning spells for Eldritch Knights and Arcane Tricksters?

Both Eldritch Knights (a subclass of fighters) and Arcane Tricksters (a subclass of rogues) pull their spells from the wizard spell list, albeit in a limited way. The way in which they do this is by only being allowed to choose spells from the evocation and abjuration schools, in the case of eldritch knights, or from only choosing from illusion and enchantment, in the case of arcane tricksters. Both classes also get very small amounts of any spell they want from the wizard spell list.

How unbalanced would it be to allow both these subclasses to choose spells regardless of school from the wizard spell list? Good comparisons may include comparisons to half casters, and of course to changes in how these classes could play.

CWE-611: Improper Restriction of XML External Entity Reference with XSL include

Veracode reports that the below code is susceptible to CWE-611: Improper Restriction of XML External Entity Reference.

XslCompiledTransform transform = new XslCompiledTransform(); transform.Load(xslwithospath); StringWriter results = new StringWriter(); using (XmlReader reader = XmlReader.Create(new StringReader(xml))) 

Unfortunately I can’t set the XMLResolver to null because the XSLT uses an include

<xsl:include href="localfileNameWithoutPath"/> 

Is the only resolution to rewrite the XSLT so that it does not have XSL includes, and then set the resolver to null?