Packages and file ownerships
- First Post
- Replies
- Stats
-
Go to
- ----- 2024 -----
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2023 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2022 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2021 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2020 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2019 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2018 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2017 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2016 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2015 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2014 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2013 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2012 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2011 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2010 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2009 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2008 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2007 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2006 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2005 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2004 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2003 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2002 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2001 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2000 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 1999 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 1998 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
When installing packages with the package UI as root (21.4.6 on RedHat
7.2), the extracted files get their ownerships from the tarballs, which
is not nice. Nowadays the files seem to have 103/100 as their owner.
Some may consider it as a security hole, not?
I did some research but forcing the ownerships to be the installer's
doesn't seem to be a trivial one. Newer GNU tar's have the
--no-same-owner option, some have the --owner option which could be used
together with (user-uid). And then, of course, there's chmod.
OTOH, there should be no suid thingies inside tarballs if we're
extracting as root.
Is there a way around this, maybe something could be done when making
the tarballs?
--
Ville Skyttä
ville.skytta(a)xemacs.org
>>>> "Ville" == Ville Skyttä
<ville.skytta(a)xemacs.org> writes:
Ville> When installing packages with the package UI as root
Ville> (21.4.6 on RedHat 7.2), the extracted files get their
Ville> ownerships from the tarballs, which is not nice. Nowadays
Ville> the files seem to have 103/100 as their owner. Some may
Ville> consider it as a security hole, not?
I suppose. This is always an issue with root.
I guess Steve could (1) make sure there are no set-id binaries in the
packages, and (2) force the ownership with tar --owner=0 --group=0 (I
believe this should work fine for Steve's ordinary user).
--
Institute of Policy and Planning Sciences http://turnbull.sk.tsukuba.ac.jp
University of Tsukuba Tennodai 1-1-1 Tsukuba 305-8573 JAPAN
Don't ask how you can "do" free software business;
ask what your business can "do for" free software.
|--==> "SJT" == Stephen J Turnbull <stephen(a)xemacs.org> writes:
>>>>>"Ville" == Ville Skyttä
<ville.skytta(a)xemacs.org> writes:
Ville> When installing packages with
the package UI as root
Ville> (21.4.6 on RedHat 7.2), the extracted files get their
Ville> ownerships from the tarballs, which is not nice. Nowadays
Ville> the files seem to have 103/100 as their owner. Some may
Ville> consider it as a security hole, not?
SJT> I suppose. This is always an issue with root.
SJT> I guess Steve could
SJT> (1) make sure there are no set-id binaries in the
SJT> packages,
Which there aren't.
SJT> (2) force the ownership with tar --owner=0 --group=0
Yep, I can do this. I'll patch 'XEmacs.rules'.
--
|---<Steve Youngs>---------------<GnuPG KeyID: 10D5C9C5>---|
| XEmacs - It's not just an editor. |
| It's a way of life. |
|------------------------------------<youngs(a)xemacs.org>---|
8273
days inactive
8275
days old
2 comments
3 participants
tags (0)
participants (3)
-
Stephen J. Turnbull -
Steve Youngs -
Ville Skyttä