>>>>> "S" == SRE <eckert@climber.org> writes:
S> Hmmm. I thought this was a setuid script.
It is, but it is careful to drop privileges before calling the editor.
S> If it sometimes runs as the server id and sometimes runs as the user id,
S> I'm surprised and confused.
It does. This is part of the basic UNIX security model.
S> It's never possible to prove something doesn't exist, so no one can ever
S> say any program is totally safe.
There is a whole branch of computer science related to proving the
correctness of programs, but that doesn't scale to any system this big
(i.e. the OS, Perl, Majordomo, and the Internet all together).
S> What I'm not clear on is why it's desirable to let arbitrary environment
S> variables exist when there is so much code thaat no one has ever scanned
S> for defects.
I don't believe I've said that it's desirable. Up until yesterday I had
maintained that someone needed to come up with a good reason for doing it
besides nebulous statements that there might be problems, maybe, but we
can't find one. (After all, Perl has extensive mechanisms in place to make
sure that problems don't exist, and if we can't trust Perl then we have a
basic underlying flaw that essentially invalidates our entire suite of
software.) But Dave explained his position yesterday well enough that I
understood it and agreed with it.
S> Is there a list of environment variables that are INTENTIONALLY used by
S> Mj2 ?
No. I started a list in my reply to Dave, but I don't know enough about
the web stuff to know what use it makes of the environment. (I suspect
quite a bit.) Everyone here should feel free to add to that list.
S> What would happen if an anxious system administrator re-wrote the
S> wrappers to delete all environmment variables and change BOTH the
S> effective and real uid/gid ?
Then the editing portion of mj_shell would fail (because of the wrapper
screwing with the UID when it's not supposed to) and the CGI scripts would
stop working completely because they rely heavily on fetching stuff from
the environment. I think the email stuff would keep working, assuming that
your MTA requires the wrapper in the first place. Neither the CGI or shell
interfaces could save much useful information in the session log.
So basically you remove a lot of the features that actually make the
software useful.
- J<
References:
|
|
