From owner-cvs-all@FreeBSD.ORG Mon Dec 15 05:31:17 2003 Return-Path: Delivered-To: cvs-all@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 7D9F016A4CE; Mon, 15 Dec 2003 05:31:17 -0800 (PST) Received: from gw.celabo.org (gw.celabo.org [208.42.49.153]) by mx1.FreeBSD.org (Postfix) with ESMTP id 6F06A43D36; Mon, 15 Dec 2003 05:31:15 -0800 (PST) (envelope-from nectar@freebsd.org) Received: from localhost (localhost [127.0.0.1]) by gw.celabo.org (Postfix) with ESMTP id D79B054883; Mon, 15 Dec 2003 07:31:14 -0600 (CST) Received: from gw.celabo.org ([127.0.0.1]) by localhost (hellblazer.celabo.org [127.0.0.1]) (amavisd-new, port 10024) with SMTP id 05306-10; Mon, 15 Dec 2003 07:31:04 -0600 (CST) Received: from lum.celabo.org (dhcp-204.celabo.org [10.0.1.204]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client CN "lum.celabo.org", Issuer "celabo.org CA" (verified OK)) by gw.celabo.org (Postfix) with ESMTP id 17D335482B; Mon, 15 Dec 2003 07:31:04 -0600 (CST) Received: from freebsd.org (localhost [127.0.0.1]) by lum.celabo.org (Postfix) with ESMTP id 854991595AC; Mon, 15 Dec 2003 07:31:04 -0600 (CST) Message-ID: <3FDDB797.9080703@freebsd.org> Date: Mon, 15 Dec 2003 07:31:03 -0600 From: Jacques Vidrine User-Agent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.6b) Gecko/20031205 Thunderbird/0.4 X-Accept-Language: en-us, en MIME-Version: 1.0 To: Brooks Davis References: <3FDC7D65.3040406@aueb.gr> <20031214213624.GA4077@Odin.AC.HMC.Edu> <3FDCEA54.2040705@aueb.gr> <20031215005702.GB4077@Odin.AC.HMC.Edu> In-Reply-To: <20031215005702.GB4077@Odin.AC.HMC.Edu> X-Enigmail-Version: 0.82.4.0 X-Enigmail-Supports: pgp-inline, pgp-mime Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit cc: Diomidis Spinellis cc: src-committers@FreeBSD.org cc: Robert Watson cc: cvs-src@FreeBSD.org cc: dds@FreeBSD.org cc: cvs-all@FreeBSD.org Subject: Re: cvs commit: src UPDATING (initgroups) X-BeenThere: cvs-all@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: CVS commit messages for the entire tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 15 Dec 2003 13:31:17 -0000 Brooks Davis said the following on 12/14/03 6:57 PM: > I think we should put this in in stable and probably never remove it. > I'd defintly object if we removed it before 4.11 because we need to ship > at least one release with a warning before breaking things since I don't > think this is a security issue. If someone can come up with a way not > being a member of a group would be a security issue I'd withdraw that > objection and just suggest that we add a special case syslog to stable > to avoid confusion. Some authorization decisions grant access on the basis of what groups you are *not* in: the file system, at least, and who knows what applications may do. On the other hand, this change *will* break some sites without *actually* having a security impact. I tend to agree with you: this should be a loud and clear warning for at least one release before being made fatal. Cheers, -- Jacques Vidrine NTT/Verio SME FreeBSD UNIX Heimdal nectar@celabo.org jvidrine@verio.net nectar@freebsd.org nectar@kth.se