Re: [akr@M17N.ORG: cvs security problem]

[Tanaka Akira]

In article <[EMAIL PROTECTED]>,
  [EMAIL PROTECTED] (Larry Jones) writes:

> It's a known problem.  Like it says in the Cederqvist manual (under
> "Security considerations with password authentication"):
> 
>       ... once a user has non-read-only access to the repository, she
>       can execute programs on the server system through a variety of
>       means.

I believe that most of the problems can be prevented by carefully
designed chroot jail without cvs modification.  I think that the
problem is serious because chroot cannot prevent it.

> Fixing this will require some serious redesign -- the simplest fix would
> be to just get rid of checkin and update programs, but I'm not sure how
> people would feel about that.

I hope that and my patch do that.  If someone want the function, it
should be configurable and disabled by default.
-- 
Tanaka Akira