Re: About a rc.d script and "--user ${puser}"

[Cem Kayali <cemkayali%eticaret.com.tr@localhost>]

Hello!

I created a ticket about this: pkg/40532 & 
http://www.netbsd.org/cgi-bin/query-pr-single.pl?number=40532

This looks quite strange to me, because privoxy has write access to 
chown=root:wheel & chmod=661 files though "gropinfo wheel" does not have 
privoxy user.

Regards,
Cem




Thor Lancelot Simon, 02/01/09 21:19:
> On Sun, Feb 01, 2009 at 06:07:17PM +0200, Cem Kayali wrote:
>   
> > Hello!
> >
> > I noticed that a (pkgsrc) /etc/rc.d script has wheel permission although  
> > it has command argument
> >     
>
> What do you mean, "has wheel permission"?  Do you mean that the script's
> permissions look like this:
>
>         -rwxr-sr-x  1 root  wheel  0 Feb  1 14:11 foo.sh
>
> Or like this?
>
>         -rwxr-xr-x  1 root  wheel  0 Feb  1 14:11 foo.sh
>
> Standard NetBSD kernels do not support setgid scripts, so the two
> permissions are equivalent.  I do not understand why you think there is,
> as you put it, "an internal security hole" in either case.
>
> Thor
>
>