Date: Tue, 2 Mar 2004 10:38:31 -0500 From: Will Andrews <will@csociety.org> To: "Jacques A. Vidrine" <nectar@FreeBSD.org> Cc: ports-committers@freebsd.org Subject: Re: cvs commit: ports/audio/arts Makefile Message-ID: <20040302153831.GK13724@sirius.firepipe.net> In-Reply-To: <20040302134752.GB678@lum.celabo.org> References: <200402072116.i17LGmkA007339@repoman.freebsd.org> <20040301212624.GF8957@lum.celabo.org> <200403020912.29657.michaelnottebrock@gmx.net> <20040302134752.GB678@lum.celabo.org>
next in thread | previous in thread | raw e-mail | index | archive | help
--4LFBTxd4L5NLO6ly Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Tue, Mar 02, 2004 at 07:47:52AM -0600, Jacques A. Vidrine wrote: > P.S. I don't mean to pick on this port in particular. I believe there > are other ports that install set-user-ID binaries where it is not > essential. I just haven't had a chance to make a sweep of the tree yet > to identify them. I agree with Michael - I'd rather have working software than a false sense of security, when it comes to desktop software. If you are going to push a "make all setuid bits optional" agenda, I suggest coming up with a standard means of letting the administrator specify their policy regarding those. You could also offer alternate means of achieving the effect that set-id wrappers/programs intend with their privileges. Unfortunately, in arts' case, setpriority(2) is superuser-only. Perhaps in FreeBSD 5, we should start implementing standard means of allowing programs like artsd to call setpriority(2) without privileges, e.g. through MAC. Regards, --=20 wca --4LFBTxd4L5NLO6ly Content-Type: application/pgp-signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.3 (FreeBSD) iD8DBQFARKp2F47idPgWcsURAu20AJ9nemlVP9ayELZ+h7r1iik1nS04qwCfbuyl cZaV/pTMkdf3HZOmNUhGT24= =MPZx -----END PGP SIGNATURE----- --4LFBTxd4L5NLO6ly--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20040302153831.GK13724>