Re: coupe things RedHat does well and Debian should too
Ethan Benson writes:
> im not all that familier with the way suidperl works but why can't
> it check for nosuid mount options before allowing a script located
> on a nosuid filesystem from being run suid?
Take it up with the Perl people; my personal reaction is 'yuck' but
they may have a different view. IMHO 'nosuid' should just mean 'no
suid executables on this filesystem', not 'your users can't possibly
get a suid program to excute arbitrary code from this filesystem'; you
have to audit every single suid program and add such a filesystem
check (which isn't portable to many other *nixes anyway). I'm wary of
lulling people into a false sense of security.
--
There is no TRUTH. There is no REALITY. There is no CONSISTENCY. There
are no ABSOLUTE STATEMENTS. I'm very probably wrong. -- BSD fortune(6)
Reply to: