Re: portmap (was Re: SECURITY PROBLEM: autofs [all versions])

[jpb <jpb@creol.ucf.edu>]

Anthony Towns wrote:
> More problematic though, is that netbase and friends not only rerun
> update-rc.d on upgrades, but they also restart the service (or run
> /etc/init.d/* restart or something similar anyway). So even replacing
> all the S* symlinks with K* symlinks, you can still end up with portmap
> (or whatever) running when you don't want it. The only correct way to
> handle this at the moment is by adding an exit 0 somewhere in your init.d
> script. It's ugly, but it works.
> 
> A much better solution is possible, but it requires some scripts to be
> distributed with dpkg/sysvinit and filerc, and it requires maintainers
> to change their calls to /etc/init.d/* restart (or whatever), and some
> policy updates to document the new requiremnets. People seem quite happy
> to keep complaining about this, but that's been done already, if you
> want to do something useful, get the stuff organised make the policy
> proposal and generally get a better, working system ready and deployed.

How about something like Irix's chkconfig?  Make the init.d scripts
source /etc/config.d/whatever, and then exit 0 if some environment
variable (RUN for example) isn't set to 1.

This could be combined with the idea from another thread to have an
/etc/config.d directory that would let users set various environment
variables without messing with the actual init.d scripts.
-- 
Joe Block <jpb@creol.ucf.edu>
CREOL System Administrator

Social graces are the packet headers of everyday life.