Rocksolid Light

Welcome to RetroBBS

mail  files  register  newsreader  groups  login

Message-ID:  

Victory or defeat!


devel / comp.unix.programmer / Re: Restricting who can run a set-user-id-root executable

SubjectAuthor
* Restricting who can run a set-user-id-root executableNoob
+* Re: Restricting who can run a set-user-id-root executableBen Bacarisse
|`* Re: Restricting who can run a set-user-id-root executableNoob
| `- Re: Restricting who can run a set-user-id-root executableRichard Kettlewell
+* Re: Restricting who can run a set-user-id-root executableKenny McCormack
|+- Re: Restricting who can run a set-user-id-root executableNoob
|`* Re: Restricting who can run a set-user-id-root executableJohn McCue
| `* Re: Restricting who can run a set-user-id-root executableNoob
|  `* Re: Restricting who can run a set-user-id-root executableJohn McCue
|   `* Re: Restricting who can run a set-user-id-root executableNoob
|    +- Re: Restricting who can run a set-user-id-root executableJohn McCue
|    `* Re: Restricting who can run a set-user-id-root executableKenny McCormack
|     `* Re: Restricting who can run a set-user-id-root executableRainer Weikusat
|      `* Re: Restricting who can run a set-user-id-root executableKenny McCormack
|       `* Re: Restricting who can run a set-user-id-root executableRainer Weikusat
|        `* Re: Restricting who can run a set-user-id-root executableKenny McCormack
|         `* Re: Restricting who can run a set-user-id-root executableRainer Weikusat
|          `* Re: Restricting who can run a set-user-id-root executableKenny McCormack
|           `* Re: Restricting who can run a set-user-id-root executableRainer Weikusat
|            `- Re: Restricting who can run a set-user-id-root executableKenny McCormack
+* Re: Restricting who can run a set-user-id-root executableJames K. Lowden
|+- Re: Restricting who can run a set-user-id-root executableKenny McCormack
|+* Re: Restricting who can run a set-user-id-root executableKeith Thompson
||`* Re: Restricting who can run a set-user-id-root executableNoob
|| `- Re: Restricting who can run a set-user-id-root executableKeith Thompson
|`* Re: Restricting who can run a set-user-id-root executableNoob
| `- Re: Restricting who can run a set-user-id-root executableJames K. Lowden
`* Re: Restricting who can run a set-user-id-root executableRainer Weikusat
 `* Re: Restricting who can run a set-user-id-root executableNoob
  `- Re: Restricting who can run a set-user-id-root executableRainer Weikusat

Pages:12
Re: Restricting who can run a set-user-id-root executable

<slrrr8$414i$1@news.xmission.com>

  copy mid

https://www.rocksolidbbs.com/devel/article-flat.php?id=16747&group=comp.unix.programmer#16747

  copy link   Newsgroups: comp.unix.programmer
Path: i2pn2.org!i2pn.org!weretis.net!feeder6.news.weretis.net!xmission!nnrp.xmission!.POSTED.shell.xmission.com!not-for-mail
From: gazelle@shell.xmission.com (Kenny McCormack)
Newsgroups: comp.unix.programmer
Subject: Re: Restricting who can run a set-user-id-root executable
Date: Tue, 2 Nov 2021 17:17:28 -0000 (UTC)
Organization: The official candy of the new Millennium
Message-ID: <slrrr8$414i$1@news.xmission.com>
References: <sljmug$8di$2@dont-email.me> <871r3zexbz.fsf@doppelsaurus.mobileactivedefense.com> <slrfm2$3r50$1@news.xmission.com> <87h7cuo7xp.fsf@doppelsaurus.mobileactivedefense.com>
Injection-Date: Tue, 2 Nov 2021 17:17:28 -0000 (UTC)
Injection-Info: news.xmission.com; posting-host="shell.xmission.com:166.70.8.4";
logging-data="132242"; mail-complaints-to="abuse@xmission.com"
X-Newsreader: trn 4.0-test77 (Sep 1, 2010)
Originator: gazelle@shell.xmission.com (Kenny McCormack)
 by: Kenny McCormack - Tue, 2 Nov 2021 17:17 UTC

In article <87h7cuo7xp.fsf@doppelsaurus.mobileactivedefense.com>,
Rainer Weikusat <rweikusat@talktalk.net> wrote:
>gazelle@shell.xmission.com (Kenny McCormack) writes:
>> In article <871r3zexbz.fsf@doppelsaurus.mobileactivedefense.com>,
>> Rainer Weikusat <rweikusat@talktalk.net> wrote:
>>>gazelle@shell.xmission.com (Kenny McCormack) writes:
>>>> In article <slnds7$n5q$1@dont-email.me>, Noob <root@127.0.0.1> wrote:
>>>
>>>[...]
>>>
>>>>>It's not yet obvious to me (at this point) why it's a terrible idea
>>>>>to hard-code the check in the binary, though.
>>>>
>>>> There's nothing per se wrong with it - it will work - but it is just not
>>>> best practice - and not as "future-proof" as using a group would be.
>>>
>>>It "will work" for as long as all systems the binary is copied to will
>>>always associate the intended user with the hard-coded UID. As there's
>>>nothing in the binary which screams "I have 66771 hard-coded as UID for
>>>user grmblfzz!", that's bound to break even on a single system as stuff
>>>like this tends to be forgotten over time.
>>
>> IOW, you agree with me, 100%. Thanks.
>
>I don't. Hard-coding system configuration information will work for as
>long as the binary is regarded as configuration and the system
>configuration as binary, IOW, what's supposed to be changeable by users
>becomes cast in stone in this way while developers can "save some work"
>in exchange for that.
>
>I consider this a wrong design choice.

Right. We totally agree. Note: You may have to go back and read
carefully, and note which parts were written by who and when and why. It
make take some careful reading to get the point.

Don't worry. I'll wait.

--
The randomly chosen signature file that would have appeared here is more than 4
lines long. As such, it violates one or more Usenet RFCs. In order to remain
in compliance with said RFCs, the actual sig can be found at the following URL:
http://user.xmission.com/~gazelle/Sigs/Rorschach

Re: Restricting who can run a set-user-id-root executable

<87czninyw3.fsf@doppelsaurus.mobileactivedefense.com>

  copy mid

https://www.rocksolidbbs.com/devel/article-flat.php?id=16748&group=comp.unix.programmer#16748

  copy link   Newsgroups: comp.unix.programmer
Path: i2pn2.org!i2pn.org!news.swapon.de!fu-berlin.de!uni-berlin.de!individual.net!not-for-mail
From: rweikusat@talktalk.net (Rainer Weikusat)
Newsgroups: comp.unix.programmer
Subject: Re: Restricting who can run a set-user-id-root executable
Date: Tue, 02 Nov 2021 19:25:16 +0000
Lines: 47
Message-ID: <87czninyw3.fsf@doppelsaurus.mobileactivedefense.com>
References: <sljmug$8di$2@dont-email.me>
<871r3zexbz.fsf@doppelsaurus.mobileactivedefense.com>
<slrfm2$3r50$1@news.xmission.com>
<87h7cuo7xp.fsf@doppelsaurus.mobileactivedefense.com>
<slrrr8$414i$1@news.xmission.com>
Mime-Version: 1.0
Content-Type: text/plain
X-Trace: individual.net B4P+Z6Pauvi0/D0krTzJfQD72HowuXbaG/WHt1OE3joFcO7Gs=
Cancel-Lock: sha1:oaqE2sdy2OC0AocsintA/IhDKC8= sha1:Ynt4HdrLLcCRY3AXkqzfzUgB2P4=
User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/24.5 (gnu/linux)
 by: Rainer Weikusat - Tue, 2 Nov 2021 19:25 UTC

gazelle@shell.xmission.com (Kenny McCormack) writes:
> In article <87h7cuo7xp.fsf@doppelsaurus.mobileactivedefense.com>,
> Rainer Weikusat <rweikusat@talktalk.net> wrote:
>>gazelle@shell.xmission.com (Kenny McCormack) writes:
>>> In article <871r3zexbz.fsf@doppelsaurus.mobileactivedefense.com>,
>>> Rainer Weikusat <rweikusat@talktalk.net> wrote:
>>>>gazelle@shell.xmission.com (Kenny McCormack) writes:
>>>>> In article <slnds7$n5q$1@dont-email.me>, Noob <root@127.0.0.1> wrote:
>>>>
>>>>[...]
>>>>
>>>>>>It's not yet obvious to me (at this point) why it's a terrible idea
>>>>>>to hard-code the check in the binary, though.
>>>>>
>>>>> There's nothing per se wrong with it - it will work - but it is just not
>>>>> best practice - and not as "future-proof" as using a group would be.
>>>>
>>>>It "will work" for as long as all systems the binary is copied to will
>>>>always associate the intended user with the hard-coded UID. As there's
>>>>nothing in the binary which screams "I have 66771 hard-coded as UID for
>>>>user grmblfzz!", that's bound to break even on a single system as stuff
>>>>like this tends to be forgotten over time.
>>>
>>> IOW, you agree with me, 100%. Thanks.
>>
>>I don't. Hard-coding system configuration information will work for as
>>long as the binary is regarded as configuration and the system
>>configuration as binary, IOW, what's supposed to be changeable by users
>>becomes cast in stone in this way while developers can "save some work"
>>in exchange for that.
>>
>>I consider this a wrong design choice.
>
> Right. We totally agree. Note: You may have to go back and read
> carefully, and note which parts were written by who and when and why. It
> make take some careful reading to get the point.

I don't agree with your "it will work, it's just not best practice and
not as future proof as" judgement. It will only 'work' under very specific
circumstances and at the expense of breaking other parts of the system.

That's something people might (for more or less good reasons) not be
worried about but this should at least be an informed choice.

Figuratively spoken: Kicking the door to one's home in instead of
opening it with a key will also 'work'. But afterwards, the door won't
work anymore.

Re: Restricting who can run a set-user-id-root executable

<sls6la$46lb$2@news.xmission.com>

  copy mid

https://www.rocksolidbbs.com/devel/article-flat.php?id=16749&group=comp.unix.programmer#16749

  copy link   Newsgroups: comp.unix.programmer
Path: i2pn2.org!i2pn.org!weretis.net!feeder6.news.weretis.net!xmission!nnrp.xmission!.POSTED.shell.xmission.com!not-for-mail
From: gazelle@shell.xmission.com (Kenny McCormack)
Newsgroups: comp.unix.programmer
Subject: Re: Restricting who can run a set-user-id-root executable
Date: Tue, 2 Nov 2021 20:22:02 -0000 (UTC)
Organization: The official candy of the new Millennium
Message-ID: <sls6la$46lb$2@news.xmission.com>
References: <sljmug$8di$2@dont-email.me> <87h7cuo7xp.fsf@doppelsaurus.mobileactivedefense.com> <slrrr8$414i$1@news.xmission.com> <87czninyw3.fsf@doppelsaurus.mobileactivedefense.com>
Injection-Date: Tue, 2 Nov 2021 20:22:02 -0000 (UTC)
Injection-Info: news.xmission.com; posting-host="shell.xmission.com:166.70.8.4";
logging-data="137899"; mail-complaints-to="abuse@xmission.com"
X-Newsreader: trn 4.0-test77 (Sep 1, 2010)
Originator: gazelle@shell.xmission.com (Kenny McCormack)
 by: Kenny McCormack - Tue, 2 Nov 2021 20:22 UTC

In article <87czninyw3.fsf@doppelsaurus.mobileactivedefense.com>,
Rainer Weikusat <rweikusat@talktalk.net> wrote:
....
>I don't agree with your "it will work, it's just not best practice and
>not as future proof as" judgement. It will only 'work' under very specific
>circumstances and at the expense of breaking other parts of the system.
>
>That's something people might (for more or less good reasons) not be
>worried about but this should at least be an informed choice.
>
>Figuratively spoken: Kicking the door to one's home in instead of
>opening it with a key will also 'work'. But afterwards, the door won't
>work anymore.

Oh well. Back to reading comprehension school for you...

I said "It will work (*), but it is not best practice (**)". What more can
I say?

(*) Which it will.
(**) Which it (clearly) isn't.

--
"There are two things that are important in politics.
The first is money and I can't remember what the second one is."
- Mark Hanna -

Re: Restricting who can run a set-user-id-root executable

<878ry6nt78.fsf@doppelsaurus.mobileactivedefense.com>

  copy mid

https://www.rocksolidbbs.com/devel/article-flat.php?id=16750&group=comp.unix.programmer#16750

  copy link   Newsgroups: comp.unix.programmer
Path: i2pn2.org!i2pn.org!news.swapon.de!fu-berlin.de!uni-berlin.de!individual.net!not-for-mail
From: rweikusat@talktalk.net (Rainer Weikusat)
Newsgroups: comp.unix.programmer
Subject: Re: Restricting who can run a set-user-id-root executable
Date: Tue, 02 Nov 2021 21:28:11 +0000
Lines: 26
Message-ID: <878ry6nt78.fsf@doppelsaurus.mobileactivedefense.com>
References: <sljmug$8di$2@dont-email.me>
<87h7cuo7xp.fsf@doppelsaurus.mobileactivedefense.com>
<slrrr8$414i$1@news.xmission.com>
<87czninyw3.fsf@doppelsaurus.mobileactivedefense.com>
<sls6la$46lb$2@news.xmission.com>
Mime-Version: 1.0
Content-Type: text/plain
X-Trace: individual.net 7LGpJ4es7cpCOmqIBFw0FgUGVBEt1/c2Crt/bQWdpQ6k4M2GU=
Cancel-Lock: sha1:ozahmMwUBb6rD10a+A/azpGE6dw= sha1:dI7CEcSExZwUabvhegrLiBcwmz0=
User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/24.5 (gnu/linux)
 by: Rainer Weikusat - Tue, 2 Nov 2021 21:28 UTC

gazelle@shell.xmission.com (Kenny McCormack) writes:
> Rainer Weikusat <rweikusat@talktalk.net> wrote:
> ...
>>I don't agree with your "it will work, it's just not best practice and
>>not as future proof as" judgement. It will only 'work' under very specific
>>circumstances and at the expense of breaking other parts of the system.
>>
>>That's something people might (for more or less good reasons) not be
>>worried about but this should at least be an informed choice.
>>
>>Figuratively spoken: Kicking the door to one's home in instead of
>>opening it with a key will also 'work'. But afterwards, the door won't
>>work anymore.
>
> Oh well. Back to reading comprehension school for you...
>
> I said "It will work (*), but it is not best practice (**)". What more can
> I say?
>
> (*) Which it will.
> (**) Which it (clearly) isn't.

And I said, Mr InNeedOfReadingComprehension, "it really doesn't work"
and providing a reason for that. People may disagree with this
assessment, but that's my opinion.

Re: Restricting who can run a set-user-id-root executable

<sltmv2$4vqm$1@news.xmission.com>

  copy mid

https://www.rocksolidbbs.com/devel/article-flat.php?id=16751&group=comp.unix.programmer#16751

  copy link   Newsgroups: comp.unix.programmer
Path: i2pn2.org!i2pn.org!weretis.net!feeder6.news.weretis.net!xmission!nnrp.xmission!.POSTED.shell.xmission.com!not-for-mail
From: gazelle@shell.xmission.com (Kenny McCormack)
Newsgroups: comp.unix.programmer
Subject: Re: Restricting who can run a set-user-id-root executable
Date: Wed, 3 Nov 2021 10:06:26 -0000 (UTC)
Organization: The official candy of the new Millennium
Message-ID: <sltmv2$4vqm$1@news.xmission.com>
References: <sljmug$8di$2@dont-email.me> <87czninyw3.fsf@doppelsaurus.mobileactivedefense.com> <sls6la$46lb$2@news.xmission.com> <878ry6nt78.fsf@doppelsaurus.mobileactivedefense.com>
Injection-Date: Wed, 3 Nov 2021 10:06:26 -0000 (UTC)
Injection-Info: news.xmission.com; posting-host="shell.xmission.com:166.70.8.4";
logging-data="163670"; mail-complaints-to="abuse@xmission.com"
X-Newsreader: trn 4.0-test77 (Sep 1, 2010)
Originator: gazelle@shell.xmission.com (Kenny McCormack)
 by: Kenny McCormack - Wed, 3 Nov 2021 10:06 UTC

In article <878ry6nt78.fsf@doppelsaurus.mobileactivedefense.com>,
Rainer Weikusat <rweikusat@talktalk.net> wrote:
>gazelle@shell.xmission.com (Kenny McCormack) writes:
>> Rainer Weikusat <rweikusat@talktalk.net> wrote:
>> ...
>>>I don't agree with your "it will work, it's just not best practice and
>>>not as future proof as" judgement. It will only 'work' under very specific
>>>circumstances and at the expense of breaking other parts of the system.
>>>
>>>That's something people might (for more or less good reasons) not be
>>>worried about but this should at least be an informed choice.
>>>
>>>Figuratively spoken: Kicking the door to one's home in instead of
>>>opening it with a key will also 'work'. But afterwards, the door won't
>>>work anymore.
>>
>> Oh well. Back to reading comprehension school for you...
>>
>> I said "It will work (*), but it is not best practice (**)". What more can
>> I say?
>>
>> (*) Which it will.
>> (**) Which it (clearly) isn't.
>
>And I said, Mr InNeedOfReadingComprehension, "it really doesn't work"
>and providing a reason for that. People may disagree with this
>assessment, but that's my opinion.
>

Projection, much?

--
I voted for Trump because I thought he'd make pussy grabbing legal.
I honestly don't see any other way America could be made great again.


devel / comp.unix.programmer / Re: Restricting who can run a set-user-id-root executable

Pages:12
server_pubkey.txt

rocksolid light 0.9.81
clearnet tor