Re: /var/games/package must be 770

[Glenn Maynard <g_deb@zewt.org>]

On Wed, Feb 27, 2002 at 05:47:42PM +0100, Bill Allombert wrote:
> Policy 12.11 state that highscore files must be put in
> a directory with permission 770 root.games, and this is a

Nope.  It says "Each game decides on its own security policy."

> This is a minor security problem :  if the highscore is always

It's not a security problem.  It's a risk that people might put in fake
high scores.  (If you really want to call it "security", it's security
within the scope of a game, which doesn't really deserve any more
attention than any other normal bug, unlike real security problems.)

> drwxrwxr-x    2 root     games        4096 sep 22 02:41 bombardier
> drwxrwsr-x    3 root     games        4096 fév 20 14:50 falconseye
> drwxrwxr-x    2 root     games        4096 sep 28 16:28 omega-rpg
> drwxrwsr-x    2 root     games        4096 jui  3  2001 powermanga
> drwxrwsr-x    2 root     games        4096 sep 29 23:20 xpat2

All of these should be g+s, or the data files will be created with the
user's primary group.  If usergroups are on, that'll prevent anyone else 
from writing high scores.
 
-- 
Glenn Maynard