Re: Suid Manager Proposal
On Thu, 21 Nov 1996, Chris Fearnley wrote:
cjf >I like the proposal. I think suidregister needs to be part of dpkg.
cjf >Policy should state that no package should have any suid binaries
Glad that I find some support. I tried to talk about something like this a
while ago but just drew fire for it.
cjf >>whodoneit binary user group mode
cjf >>
cjf >>Where "whodoneit" is either the package name responsible for installing the
cjf >>settings or "user" for a user override.
cjf >
cjf >I don't see the need for the whodoneit field. I think the behavor of
cjf >suidregister should be to preserve any settings found in
cjf >/etc/suid.conf. No package should override the settings ever. The
cjf >package can ask for the proper settings on initial installation, but
cjf >would rely on /etc/suid.conf thereafter.
The need for the whodoneit arises if the package is upgraded and has some
changes to the suid permissions. If the user has overridden something then
the package should not change that setting in /etc/suid.conf on upgrade.
If it was not changed then the package can change the permissions.
Think about an upgrade of sendmail to make it only setgid instead of
setuid. In that case "suidregister" must be able to decide if it should
follow the package contents or the user specs.
cjf >>-f Force. A package does not allow the user to override settings. Enforce the
cjf >> setting at all times. If a "user" line is present in /etc/suid.conf erase it.
cjf >
cjf >No. I don't think a -f option is appropriate. I don't want any
cjf >package to use this feature ... ever!
There are packages that must have certain permissions on files in order to
operate. It also can be used for example to force a file NEVER to have
suid permissions.
The suid manager is I think also useful to manager NON suid permissions to
some extend.
--- +++ --- +++ --- +++ --- +++ --- +++ --- +++ --- +++ ---
PGP Public Key = FB 9B 31 21 04 1E 3A 33 C7 62 2F C0 CD 81 CA B5
--
TO UNSUBSCRIBE FROM THIS MAILING LIST: e-mail the word "unsubscribe" to
debian-devel-REQUEST@lists.debian.org . Trouble? e-mail to Bruce@Pixar.com
Reply to: