[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: More Debian v1.2 things...



On 23 Oct 1996, Kevin Dalley wrote:

> Craig Sanders <cas@taz.net.au> writes:
> 
> > Another point to think about is whether such a program should be setuid
> > root or whether the admin should su to root before running it. It should
> > be possible to make it safe if there is a, say, 'dpkg' group and your
> > tk-dselect is owned by root:dpkg and mode 4754.
> > 
> 
> It should not be setuid root.  This would be too big of a security
> hole.  Any package could install a setuid root sh.

any package can do that now, anyway.

dpkg -i only works if it's run as root.

Craig

--
TO UNSUBSCRIBE FROM THIS MAILING LIST: e-mail the word "unsubscribe" to
debian-devel-REQUEST@lists.debian.org . Trouble? e-mail to Bruce@Pixar.com


Reply to: