From owner-freebsd-questions Tue Feb 17 16:17:30 1998 Return-Path: Received: (from majordom@localhost) by hub.freebsd.org (8.8.8/8.8.8) id QAA28312 for freebsd-questions-outgoing; Tue, 17 Feb 1998 16:17:30 -0800 (PST) (envelope-from owner-freebsd-questions@FreeBSD.ORG) Received: from mhv.net (root@spice.mhv.net [199.0.0.21]) by hub.freebsd.org (8.8.8/8.8.8) with ESMTP id QAA28284 for ; Tue, 17 Feb 1998 16:17:08 -0800 (PST) (envelope-from mgraffam@mhv.net) From: mgraffam@mhv.net Received: from localhost (phundie@port102.mhv.net [206.229.41.30]) by mhv.net (8.8.5/8.7.3) with SMTP id TAA25400; Tue, 17 Feb 1998 19:16:28 -0500 Date: Tue, 17 Feb 1998 19:10:15 -0500 (EST) X-Sender: phundie@localhost To: Studded cc: Doug White , freebsd-questions@FreeBSD.ORG Subject: Re: gcc 2.8.0 In-Reply-To: <34EA1F5F.FBF8F285@san.rr.com> Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-freebsd-questions@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.ORG On Tue, 17 Feb 1998, Studded wrote: > > Blowing it away is OK. I did it pretty quickly on a 40MB printserver I > > put together last week. > > > > rm /usr/bin/gcc /usr/bin/cc /usr/libexec/cc1plus .... > > rm -rf /usr/include I agree that limited access to the C compiler helps improve the security of the system, but you must remember that you are using PC's with a free OS. How long do you think it would take for someone to install FreeBSD off of CD, get to a shell, compile the exploits they need and then upload the binaries to your system? I say 60 minutes, tops.. if the attacker is familiar with FreeBSD. I don't think total removal makes much sense on PC's with a free OS. There are too many PC's running around, and anyone can get the OS. Removing the compiler on an SGI machine makes more sense.. but even then, I have access to shell's on SGI machines.. and I'd assume a lot of other people do too. I think that a better approach is to make a "devel" group or something similar, and make all the development junk, includes, the compiler and what not all group devel owned. Then remove all perms for other users.. then only root and g devel guys can access the compiler. We hope that root and g devel can be trusted. I don't like root too much either, but hey.. thats UNIX. Michael J. Graffam (mgraffam@mhv.net) http://www.mhv.net/~mgraffam -- Philosophy, Religion, Computers, Crypto, etc "Two things fill the mind with ever new and increasing admiration and awe the more often and steadily we reflect upon them: the starry heavens above and the moral law within me. I do not seek or conjecture either of them as if they were veiled obscurities or extravagances beyond the horizon of my vision; I see them before me and connect them immediately with the consciousness of my existence." - Immanuel Kant "Critique of Practical Reason" To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message