Darren Moffat wrote:
> I'm having a hard time working out why the man command is setuid to any
> user.
>
> Exactly what is it that man MUST do to perform the job of turning nroff
> man pages into viewable text ?
Two operations are done where SUID is useful; firstly maintaining the manual
page index (remember what happens on Solaris if you haven't indexed the man
pages and someone does a man -k... it just basically says "sorry"... a SUID
man can build this on the fly for any changes detected) and secondly the
unfortunate belief on many OS's/distro's that caching nroff output is useful
(which is true for performance, but leads to systems formatting man pages as
24x80 rather than adjusting to the real window size like some of the nicer
"man" variants used to).
Both of them are performance issues, one could be addressed by having the
manual page indexes maintained by the package install process, and the
second is somewhat harder to address but somewhat more questionable in the
net performance gain (perhaps per-user caching would have a similar
performance gain without the SUID requirement - and these could be stored
in an area which is automatically cleaned regularly).
(Hmm, does BUGTRAQ need/have a FAQ for questions which are asked every few years
[why is "x" SUID; what about design flaw "y" {eg, nobody homedir}; ...] and
security holes which seem to come back from time to time [such as the
RESOLV_HOST_CONF one which recently reoccurred in a Debian unstable/testing
libc package]?)
David.
--
David Luyer Phone: +61 3 9674 7525
Senior Network Engineer P A C I F I C Fax: +61 3 9699 8693
Pacific Internet (Australia) I N T E R N E T Mobile: +61 4 1111 2983
http://www.pacific.net.au/ NASDAQ: PCNTF
