Re: [cobalt-users] security risk... is this normal?

[Greg Hewitt-Long <cobaltusers@xxxxxxxxxxxxxxxxxxx>]

At 12:29 PM 3/1/2004, you wrote:

> >
> > As Jeff pointed out, the uninstaller scripts.  The potential problem
> > I see is uninstaller scripts with rm commands in them - these are
> > currently able to be run by any shell enabled user - while package
> > default installers *SHOULD* set their data folders to be correctly
> > permissioned to prevent accidental removal but just anyone, it
> > doesn't mean they are, or remain that way.  Running the script by a
> > non-permissioned user should error all the way - at least you HOPE it
> > does.  What if the rm has a -r and you have a couple of files in
> > there with incorrectly set permission, either by installer screw
> > up,or subsequent admin mis-hap.
>
> What accident removing you are talking about?
> rpm -e removes packages.
> Nothing more is used by uninstallers, well if they are not brain
> damaged.
> RPM can't remove anything, while it haven't set database lock.
> If you are not root, you can't lock database.
> So, you get error. Permission denied. Just as expected.

Re-read it and comprehend... the uninstaller SCRIPTS (*.uninst) generally 
have other commands in them APART from rpm -e.  THOSE commands will be 
executed AS WELL and any rpm -e commends - THESE have the POTENTIAL to 
remove files you don't want removed - IF the permissions of folders and 
sub-folders are not as you would expect them to be.

> >
> > I'm in the process of training another staff member to admin these
> > boxes - I remember nearly 20 years ago screwing up a box completely
> > BY ACCIDENT - I don't want that to happen again on one of our boxes!
>
> Do not work as root.
>
> > > > On the other hand all Raq stuff is so 'modern', so anybody
> > > > expierenced a bit with a shell or php might get root in a couple
> > > > of minutes on any raq. It's really easy.
> > > > Restrict shell access!
> > >
> > >While I agree with you here, there's certainly nothing wrong with
> > >keeping a system as secure as possible.
> >
> > While I agree that there are many clients out there who should not
> > have shell access, there are others who demand it.  I'm not doing
> > away with shell access - I am trying to lock down my permissions
> > without changing the business model.
>
> And that's right, but there's no point in restricting access to
> uninstallers, cause rpm already cares about it.


I'm not talking about the calls to RPM in the uninstaller scripts - those 
aren't the commands that are a potential worry for me.

> To feel yourself happy, you may restrict rpm access, so no uninstallers
> won't ever try to work.


even if I change RPM's permissions, do I have to change rm and mv as 
well?!?!?  That will BREAK the box.

> WBR,
> Dmitry
>
>
> _____________________________________
> cobalt-users mailing list
> cobalt-users@xxxxxxxxxxxxxxx
> To subscribe/unsubscribe, or to SEARCH THE ARCHIVES, go to:
> http://list.cobalt.com/mailman/listinfo/cobalt-users