On Aug 11, 11:30 pm, dormando <dorma...@rydia.net> wrote:
> This bug is definitely not serious, and anyone claiming it as a root hole > should be strangled. Please don't run this thing as root in a place where > people can put whatever random trash they want into the system. 's/this /any/' People who care about security should try to reduce privs as much as possible. On Aug 12, 12:09 am, Trond Norbye <trond.nor...@sun.com> wrote: > If you look at the source the only way to run memcached as root is by > using -u root. What if we removed that option as well?? I guess the only > thing you would need extra privileges for would be binding to a port < > 1024, but do we really need to support that? It'd introduce a special case. Right now, if we're running as root, -u is required, but isn't checked. We'd need to check whether we're *still* running as root (which could have more than one name). > We could also look for the users noaccess or nobody and automatically > switch to one of those users if they exists if the user didn't provide > another username (and none of them is found, print out an error message > and terminate). This would make it impossible to run as root, and all > this fuzz about root exploits would just go to /dev/null where they > belong... I don't know... someone will find a way. You already have to *try* to make it run as root. I just don't understand why someone would go out of their way to do so.
