On Sunday 30 April 2006 13:36, Mark Rosenstand wrote:
> On Sun, 2006-04-30 at 12:49 +0100, Alistair John Strachan wrote:
> > Going over old ground again, any administrator a) compiling the kernel as
> > root or b) relying on GNU tar to make _security policy decisions_ is
> > completely insane.
>
> Yes, GNU tar is acting insane. Given that GNU tar is the most widely
> used tar implementation (at least for extracting linux sources), why is
> the kernel packaged to exploit this insane behaviour?
I think you're missing the point. The tar archive can have whatever the hell
permissions it likes; you as the user of tar and risking extraction as root
should know what tar does and (if you care) take action to negate it.
Even back before the kernel tar files made every file writable by all, there
were always a few files that were marked executable (!!) by all. Bottom line:
you can't rely on the permissions in the tar files.
Even if the world writable thing is fixed (obviously I would not be opposed to
this), I _strongly_ recommend that you add the two flags to tar as a root
user so that ANY tar you extract will be extracted with 100% guaranteed safe
permissions..
(You probably aren't aware of the recent bug found in the kernel build system
where, if compilation was executed as root, it would overwrite the /dev/null
node with a regular file -- now THAT'S a security problem!)
--
Cheers,
Alistair.
Third year Computer Science undergraduate.
1F2 55 South Clerk Street, Edinburgh, UK.
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[Index of Archives]
[Kernel Newbies]
[Netfilter]
[Bugtraq]
[Photo]
[Stuff]
[Gimp]
[Yosemite News]
[MIPS Linux]
[ARM Linux]
[Linux Security]
[Linux RAID]
[Video 4 Linux]
[Linux for the blind]
[Linux Resources]
