Re: Helping Out


Subject: Re: Helping Out
From: Marc Miller (itlm019@mailbox.ucdavis.edu)
Date: Tue Feb 27 2001 - 16:12:19 EST


I'd say RTFM, but briefly...

There is no problem with dropbox as long as you can avoid these scenarios:

* Dropping a folder into a dropbox
* Placing data in a dropbox that you wouldn't want any user with shell
access to be able to get to. If they can guess the file name, they can
copy it right out. I have a feeling it's because of the file being opened
RDWR when it only needs to be opened WR. That way I could turn off
setting the world-read bit and the file would still write correctly. But
I haven't had a chance to try that out.

On Tue, 27 Feb 2001, jeff wrote:

> "Marc J. Miller" wrote:
> > >What's Dropkludge? I assume it is some kludge to mimic the
> > >AppleShare Server "drop box" world write/owner rwx thingee.
> >
> > That's how it started... I eventually discovered that the same permission
> > handling that was preventing Dropboxes from working was also creating other
> > bugs. So I made the changes universal. It not only maintains rwx
> > permissions, but it also makes sure that every file created within a
> > directory has the same owner and group as the directory itself. That's
> > what Mac expects. Unfortunately, I've run into a couple of difficulties --
> > a known security hole which is extremely well-documented on Sourceforge
> > (check the DocManager) and a difficulty that when someone drops a folder
> > into a dropbox, the dropped folder also becomes a dropbox, owned by whoever
> > dropped it there. That's related to the setgid being set on the dropbox
> > and permission inheritance.
>
> Sorry about the lateness of this email.
>
> Are you saying that there are security problems inherant in matching
> file permissions to directory permissions, or that there specifically a
> problem with matching file permissions to directory permissions where
> they are world accessable ... ?
>
> I only ask because I was looking at making dropkludge available by
> share, which may be a good idea, but also may still pose a security
> concern. What's your opinion on that?
>
> --SNIP--
>
> > We have a TODO list in the CVS. That seems like a good starting point...
> > perhaps someone (Jeff?!) could update the bug tracker with some of the info
> > there and decide what bugs are critical, what bugs could wait for now, etc.
>
> I've been running through the bugs list, patching the ones I can, and
> marking down the ones for 1.4b2 and other older versions.
>
> If anyone else would like to help me run through the bugs list, it would
> be much appreciated.
>
> jeff
>
> (as usual, with tremendous apologies for the cross-posting)
>

============================================================
        /\/\arc ._|. /\/\iller (itlm019@mailbox.ucdavis.edu)
        Computer Room Consultant
        Information Technology/Lab Management
============================================================
I can be contacted through the Communication Center link from
http://www.mother.com/~mjmiller/



This archive was generated by hypermail 2b28 : Sun Oct 14 2001 - 03:04:33 EDT