Subject: Re: Fix for PR security/8069: man(1) vulnerability
To: None <tech-security@netbsd.org>
From: Simon Burge <simonb@netbsd.org>
List: tech-security
Date: 07/26/1999 14:47:34
Christoph Badura wrote:
> tv@pobox.com (Todd Vierling) writes:
>
> >On Mon, 26 Jul 1999, matthew green wrote:
> >: on second thoughts, using 'nobody' is kinda hoaky, being defined as
> >: the "unauthorised root" user on NFS, this may actually provide more
> >: access than you think...
>
> >We need an account which means "not supposed to have any privileges", to
> >which root may drop in some programs. "noaccess", anyone?
>
> daemon:daemon is there precisely for that purpose.
Some things are user and/or group daemon - don't we want something
that _no_ file or directory is owned by?
balrog:~ 5280> grep daemon /NetBSD/src/etc/mtree/NetBSD.dist
msgs uname=daemon
lock uname=uucp gname=daemon
uucp uname=uucp gname=daemon
uucppublic uname=uucp gname=daemon mode=01777
Simon.