Date: Tue, 2 Mar 2004 11:50:29 -0600 From: "Jacques A. Vidrine" <nectar@FreeBSD.org> To: Will Andrews <will@csociety.org> Cc: ports-committers@freebsd.org Subject: Re: cvs commit: ports/audio/arts Makefile Message-ID: <20040302175028.GC1377@lum.celabo.org> In-Reply-To: <20040302153831.GK13724@sirius.firepipe.net> References: <200402072116.i17LGmkA007339@repoman.freebsd.org> <20040301212624.GF8957@lum.celabo.org> <200403020912.29657.michaelnottebrock@gmx.net> <20040302134752.GB678@lum.celabo.org> <20040302153831.GK13724@sirius.firepipe.net>
next in thread | previous in thread | raw e-mail | index | archive | help
On Tue, Mar 02, 2004 at 10:38:31AM -0500, Will Andrews wrote: > On Tue, Mar 02, 2004 at 07:47:52AM -0600, Jacques A. Vidrine wrote: > > P.S. I don't mean to pick on this port in particular. I believe there > > are other ports that install set-user-ID binaries where it is not > > essential. I just haven't had a chance to make a sweep of the tree yet > > to identify them. > > I agree with Michael - I'd rather have working software than > a false sense of security, when it comes to desktop software. > > If you are going to push a "make all setuid bits optional" > agenda, I have no intention. However, for ports that do not require the set-user-ID bit in order to function (and this is demonstrably true with arts), I would like not to install with set-user-ID by default. > I suggest coming up with a standard means of letting the > administrator specify their policy regarding those. You could > also offer alternate means of achieving the effect that set-id > wrappers/programs intend with their privileges. > > Unfortunately, in arts' case, setpriority(2) is superuser-only. > Perhaps in FreeBSD 5, we should start implementing standard means > of allowing programs like artsd to call setpriority(2) without > privileges, e.g. through MAC. Yes, we should follow up on these thoughts. Cheers, -- Jacques Vidrine / nectar@celabo.org / jvidrine@verio.net / nectar@freebsd.org
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20040302175028.GC1377>