Re: Bug#57740: Security: Many files are kept a+w
- To: Jacob Kuntz <jpk@cape.com>, 57740@bugs.debian.org
- Cc: Wichert Akkerman <wichert@cistron.nl>, Scott A Crosby <crosby@qwes.math.cmu.edu>, debian-devel@lists.debian.org
- Subject: Re: Bug#57740: Security: Many files are kept a+w
- From: Sven LUTHER <luther@dpt-info.u-strasbg.fr>
- Date: Tue, 15 Feb 2000 09:50:11 +0100
- Message-id: <20000215095011.A21944@dpt-info.u-strasbg.fr>
- Mail-followup-to: Jacob Kuntz <jpk@cape.com>, 57740@bugs.debian.org, Wichert Akkerman <wichert@cistron.nl>, Scott A Crosby <crosby@qwes.math.cmu.edu>, debian-devel@lists.debian.org
- Reply-to: luther@dpt-info.u-strasbg.fr
- In-reply-to: <20000211114656.A1170@megabite.net>; from jpk@cape.com on Fri, Feb 11, 2000 at 11:46:56AM -0500
- References: <Pine.LNX.4.10.10002101237110.140-100000@qwe4.math.cmu.edu> <20000211125919.A4174@dpt-info.u-strasbg.fr> <20000211130602.B27546@cistron.nl> <20000211131525.A4294@dpt-info.u-strasbg.fr> <20000211132132.F17638@liacs.nl> <20000211132826.A4431@dpt-info.u-strasbg.fr> <20000211114656.A1170@megabite.net>
On Fri, Feb 11, 2000 at 11:46:56AM -0500, Jacob Kuntz wrote:
> Sven LUTHER (luther@dpt-info.u-strasbg.fr) wrote:
> > Ok, so where can i put example programs so that users can play with it quickly
> > without having to copy them over to their place. Do we need a /home/examples
> > or somethign such place, and symlink it from /usr/share/doc ?
>
> (from the fhs) no package should ever try to touch /home, and /usr should
> work perfectly if mounted read-only.
>
> >
> > I think i am not the only one who is having this kind of needs, imagine, i
> > install this package here ta university, and 200 students copy the files over
> > to their place, compile them and install them. Sure the files are quite small,
> > but still.
>
> certianly, everyone benefits from having examples distributed with packages,
> look at how many packages have such a dir: (on a medium sized potato system)
>
> jake@fantasia:~$ find /usr/share/doc/ -type d -name examples | wc -l
> 50
>
> having these directories world writeable means there are more than 50 places
> in the system where you might find a trojan. not a pleasant idea. also, if
> /usr on a different partition (i believe) the administrator would have to
> configure quotas for /usr too. not to mention possible loss of data during
> upgrade. it would become much more than a hassle than having read-only
> examples that people could copy.
Ok, ...
you all convinced me, ...
I will upload a fixed package during this week.
Sorry, for the inconvenience though,
Friendly,
Sven LUTHER
Reply to: