[lkml]   [2002]   [May]   [20]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: suid bit on directories
On Mon, 20 May 2002, Jesse Pollard wrote:

> That is NOT wrong. The files belong to the server. Not a user. I've been
> running a server that way for years.

This is insecure.

A user has a defined security context. If the user can create code that
is then executed in a different security context (user httpd/nobody), then
you've got a potential problem. If you have multiple users who can
create code that executes in the *same* security context, you have a
recipe for disaster.

user1 can write a web app the delete/modifies the web app, or web app
created files of user2.

Dax Kelson
Guru Labs

To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to
More majordomo info at
Please read the FAQ at

 \ /
  Last update: 2005-03-22 13:26    [W:0.092 / U:28.912 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site