Re: sendmail issues (was: Re: cron has gone to UTC time?)
Wichert Akkerman wrote:
> Previously Anthony Towns wrote:
> > Another solution (with much niftier side effects) would be implementing
> > the admintool thing (to avoid questions), and speeding up dpkg (to make
> > the actual installation faster).
>
> But speeding up doesn't help, it only shortens the vulnerable timespan.
Not necessarily. The timespan can be reduced to zero. dpkg can
create the new file under a different name, set its permissions
correctly, and then replace the old file in an atomic operation.
I think this is how it operates right now.
We'd only have to invent a way for the system administrator to
override the permissions on specific files. This could easily be much
more powerful than the suidregister hooks we now have in specific
packages. We could have a tool like dpkg-setperms that overrides the
mode and ownership of any file.
Richard Braakman
Reply to: