Date: Thu, 19 Aug 2010 16:36:44 +0200 From: Attilio Rao <attilio@freebsd.org> To: =?UTF-8?Q?Dag=2DErling_Sm=C3=B8rgrav?= <des@des.no> Cc: svn-src-head@freebsd.org, svn-src-all@freebsd.org, src-committers@freebsd.org Subject: Re: svn commit: r211393 - head/lib/libutil Message-ID: <AANLkTikVMVpM=E3x6i=zGnCqPrTis=kyA3PzhwotB=H0@mail.gmail.com> In-Reply-To: <86bp924w3w.fsf@ds4.des.no> References: <201008161132.o7GBWKhx097183@svn.freebsd.org> <86mxsm4wff.fsf@ds4.des.no> <86bp924w3w.fsf@ds4.des.no>
next in thread | previous in thread | raw e-mail | index | archive | help
2010/8/16 Dag-Erling Sm=C3=B8rgrav <des@des.no>: > Dag-Erling Sm=C3=B8rgrav <des@des.no> writes: >> Note that this commit semi-intentionally introduces another bug: in some >> cases, the user's limits will not be applied at all. =C2=A0This is by fa= r the >> lesser of two evils, and is easy (albeit time-consuming) to fix. > > Specifically, each of the files listed below needs to be audited. =C2=A0T= hose > that already call setusercontext() with the LOGIN_SETUSER flag set are > fine. =C2=A0Those that don't need to do so either instead of or shortly a= fter > calling setuid(). [snip] > -- > libexec/ftpd/ftpd.c: =C2=A0 =C2=A0setusercontext(NULL, getpwuid(0), 0, > libexec/ftpd/ftpd.c- =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 LOGIN_SETPRIORITY|LOGIN_SETRESOURCES|LOGIN_SETUMASK| > libexec/ftpd/ftpd.c- =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 LOGIN_SETMAC); > -- > libexec/ftpd/ftpd.c: =C2=A0 =C2=A0setusercontext(lc, pw, 0, > libexec/ftpd/ftpd.c- =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0LOGIN_SETLO= GIN|LOGIN_SETGROUP|LOGIN_SETPRIORITY| > libexec/ftpd/ftpd.c- =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0LOGIN_SETRE= SOURCES|LOGIN_SETUMASK|LOGIN_SETMAC); It seems to me that ftpd doesn't need any change, do you agree? Thanks, Attilio --=20 Peace can only be achieved by understanding - A. Einstein
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?AANLkTikVMVpM=E3x6i=zGnCqPrTis=kyA3PzhwotB=H0>