Skip to Content.
Sympa Menu

sm-sorcery-bugs - [SM-Sorcery-Bugs] [Bug 10865] Security error message in sorcery ?

sm-sorcery-bugs AT lists.ibiblio.org

Subject: Bugs for Sorcery are reported here

List archive

Chronological Thread  
  • From: bugzilla-daemon AT bugs.sourcemage.org
  • To: sm-sorcery-bugs AT lists.ibiblio.org
  • Subject: [SM-Sorcery-Bugs] [Bug 10865] Security error message in sorcery ?
  • Date: 7 Apr 2006 22:16:21 -0000

http://bugs.sourcemage.org/show_bug.cgi?id=10865





------- Additional Comments From jblosser-smgl AT firinn.org 2006-04-07 17:16
-------
A few additional notes in case they're useful:

0) We also ship a 'wheel' group; the 'root' group is also used for this
purpose,
as is 'adm' on some other systems. I have in the past seen a 'locate' group
for
the locate command.

1) I've never seen 'find' restricted. It uses the current user's perms when it
runs, so I'm not sure what the value would be in restricting it, they could
emulate it in a sh script, though it would be ugly.

2) 'locate' gets restricted pretty often since the database is created as the
user that runs it and then is world-readable by default, so if 'updatedb' is
run
as root, non-privileged users can 'locate' files in directories they can't
read.

3) An alternate approach to this is the 'slocate' command, which takes
permissions into account. It doesn't look like we have a spell for that, but
I'll look at adding that in a bit here. FWIW (I know this bug wasn't about
locate...).

--
Configure bugmail: http://bugs.sourcemage.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.




Archive powered by MHonArc 2.6.24.

Top of Page