SourceMage Grimoire Bug List

[bugzilla-daemon AT bugs.sourcemage.org]

http://bugs.sourcemage.org/show_bug.cgi?id=9630

           Summary: unknown bug
           Product: Prometheus
        OS/Version: All
            Status: RESOLVED
          Severity: blocker
          Priority: P1
         Component: Unknown
        AssignedTo: sm-grimoire-bugs AT lists.ibiblio.org
        ReportedBy: adam AT isurf.ca


It's generally considered bad policy to remove a group or a user from a 
system,
because then you have the possibilty of orphaned files on the system.  At the
least this can cause some intrusion detection systems to false positive alert,
since unowned files are often the sign of a compromise.  But I know people 
want
the option.  So, three things:

1) ask, and default to no (you already have this covered).
2) before removing, do a find for anything owned by the user/group you're 
about
to remove, and chown those files to nobody for user removal/chgrp to nogroup 
for
group removals.
3) log user/group addition/removal somewhere, if we don't already (the auth
facility in syslog should get these already)

Note that a problem with (2) is that it can cause files to have their access
requirements *reduced* in a very real way, since many daemons run as
nobody/nogroup, and these files are now readable by those daemons.  But if
people want the option they may as well have it.


-- 


------- Additional Comments From rabrams AT sourcemage.org  2005-09-21 23:30 
-------
Extra comment by t.fernagut AT h0m3.be on 2005-09-21 23:30:01

I think this wil be an enhancement for later. When it is requested by more 
users
or when more applications need special system users. 

I propose to keep this bug as referrence .  Should it be closed maybe ? 

-- 


------- Additional Comments From rabrams AT sourcemage.org  2005-09-21 23:30 
-------
Extra comment by t.fernagut AT h0m3.be on 2005-09-21 23:30:36

oeps .. set it  to  'later' 

-- 


------- Additional Comments From jblosser-smgl AT firinn.org  2007-03-31 23:19 
-------
reassign to sm-grimoire-bugs

-- 
Configure bugmail: http://bugs.sourcemage.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.