On 2006/07/24 17:07, Martin Costabel wrote: > > With the idea explained in that advisory, anyone allowed to run fink on > your computer can indeed execute arbitrary perl code, but they can do > this anyway, having admin privileges. I don't quite understand why this > is called a bug and what is there to fix. >
The problem here is that sudo is more tunable than the broad swipes that appear as examples in the 'sudoers' files distributed with sudo. If one has the need (and the patience), sudo is infinitely tunable. As a simple example, consider a configuration that allows admin privileges only to execute a specific Perl script and which has a 'use' or 'require' of a module in a system-wide library (say, 'use DB_File'). As a user who can run this script with admin privileges, I make my own DB_File.pm that exec's a shell (which will be running with admin privileges) and put it in a place pointed to by my PERL5LIB (so it's loaded in preference to the system-wide version).... Also note that sudo v1.6.8p12 and later implement this environment stripping as part of its normal behavior. Apple's sudo isn't there yet, but it will be sooner or later. Mark ------------------------------------------------------------------------- Take Surveys. Earn Cash. Influence the Future of IT Join SourceForge.net's Techsay panel and you'll get the chance to share your opinions on IT & business topics through brief surveys -- and earn cash http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV _______________________________________________ Fink-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/fink-users
