[lkml]   [2002]   [May]   [20]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    SubjectRe: suid bit on directories
    On Mon, 20 May 2002, Jesse Pollard wrote:

    > That is NOT wrong. The files belong to the server. Not a user. I've been
    > running a server that way for years.

    This is insecure.

    A user has a defined security context. If the user can create code that
    is then executed in a different security context (user httpd/nobody), then
    you've got a potential problem. If you have multiple users who can
    create code that executes in the *same* security context, you have a
    recipe for disaster.

    user1 can write a web app the delete/modifies the web app, or web app
    created files of user2.

    Dax Kelson
    Guru Labs

    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to
    More majordomo info at
    Please read the FAQ at

     \ /
      Last update: 2005-03-22 13:26    [W:0.020 / U:4.068 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site