Re: Suid Manager?
On 21 Nov 1996, Guy Maor wrote:
> Buddha Buck <bmbuck@acsu.buffalo.edu> writes:
>
> > I assume that qmail wants some files to be owned by these 7 users and 1
> > group, and some of those to be SUID and SGID. As I understand how dpkg
> > works, the files are unpacked before the users would be created, so
> > there is no guarantee that they will be installed with the right UIDs,
> > especially if the accounts are dynamically allocated.
>
> They're dynamically allocated, but with specific UID values. The
> values are chosen centrally. So the package has the same UID values
> on every installation.
>
>
> Guy
Let's hope that nobody here has to join an NIS domain that
happens to have these UIDs allocated already! Will the "dynamic"
allocation of these _static_ UID/GIDs detect collisions? What
will be the action in such a case? I work in a company that has
about 9,000 people in it, in two NIS domains. Although this is
surely a problem with obvious (albeit painful) solutions, we
won't necessarily address this any time soon. However unlikely
it is that we will use these upper range UIDs, we're hardly a
homogeneous Debian shop! Will the policy take the possibility of
collision into consideration (as Bruce seems to want to) and not
just assume the coast is clear?
On the subject of the subject line (which seems a different
subject at this point), I definitely favor the idea of having
centralized acountability for suid programs. After seeing
MemCo's SeOS product, I'm sure its going to become standard
technology in future commercial OS releases. In fact, HP is
working on a competing product already. I believe part of the
design goal for the 2.1 linux kernel is to provide SeOS style
system call auditing/control as well, so centralizing
accountability for (and controlling access to) suid programs
should be at least considered.
Thanks
Richard G. Roberto
richr@bear.com
011-81-3-3437-7967 - Tokyo, Japan
--
*******************************************************************************
Bear Stearns is not responsible for any recommendation, solicitation, offer or
agreement or any information about any transaction, customer account or account
activity contained in this communication.
*******************************************************************************
--
TO UNSUBSCRIBE FROM THIS MAILING LIST: e-mail the word "unsubscribe" to
debian-devel-REQUEST@lists.debian.org . Trouble? e-mail to Bruce@Pixar.com
Reply to: