[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: SECURITY PROBLEM: autofs [all versions]



On Mon, Jul 03, 2000 at 11:54:52PM -0400, Christopher W. Curtis wrote:

> I did a "chmod -x /sbin/portmap" and the init script barfed.  I saw that
> it was testing '-f' instead of '-x'.  I suggested this change and
> someone actually told me that this was correct behavior because it
> *should* fail if it was -f and not not -x.  I consider that complete
> garbage because if it was supposed to fail, what was the purpose of
> checking at all?  Why not just do a "-z /dev/zero" because if it's not
> there, it should fail anyway, right?

It's not so silly as all that.  The init script needs to perform some
kind of test since it will persist if the package is removed but not
purged.  Changes to the init script will also persist over upgrades,
which can't be said for permission changes on binaries (dpkg will
happily overwrite them).  If the test in the init script was for
executability people who wanted to disable portmap would probably do 
that, find it works and then wonder why portmap suddenly started running 
again after they upgraded netbase.  Having it fail noisily is annoying
but pervents nasty surprises.

-- 
Mark Brown  mailto:broonie@tardis.ed.ac.uk   (Trying to avoid grumpiness)
            http://www.tardis.ed.ac.uk/~broonie/
EUFS        http://www.eusa.ed.ac.uk/societies/filmsoc/

Attachment: pgpgdCKuaZLKb.pgp
Description: PGP signature


Reply to: