On Jan 17, Pat Moffitt wrote:
>
> Some of the recent upgrades have the executables set UID=0 where they were
> not in the past. This includes (but may not be limited to) the following:
>
> at
> smbmnt
> smbmount
> smbumount
>
> Do these really need to be set UID=0? Is this a security concern?
>
I don't know about 'at' (I don't have it installed) however it seems useful
for me to have those smb* packages UID=0. It allows the lusers to mount
remote samba shares without having to beg the sysadmin to do it for them or
add them to a sudoers file. I would imagine that the people who throw
together the smbmount package know what they are doing and have considered
the security implications and decided that there are none.
Personnaly I would leave them UID=0 as I find it invalable, however you may
not want lusers to smbmount shares, if this is the case remove the package
(if you also don't use it) or remove the UID=0 feature.
Alex
--
_________________________________________
/ You have all eternity to be cautious in \
| when you're dead. |
| |
\ -- Lois Platford /
-----------------------------------------
\ ^__^
\ (oo)\_______
(__)\ )\/\
||----w |
|| ||
Attachment:
pgpFOFcD3EL5V.pgp
Description: PGP signature