Hi! On Sun, 2008-05-11 at 15:22:59 +0200, Raphael Hertzog wrote: > On Sun, 11 May 2008, [email protected] wrote: > > Please make all and create new /var/log/dpkg.log* in 644 mode. > > I see no reason for not letting users see what is going on. > > The can do dpkg -l anyway, and the only files not readable by the user > > in e.g., /var/lib/dpkg/ are some 0 byte lock files too. > > Why should this log file be treated differently? If the user is part of > the adm group, he can see the logs, otherwise he can't.
Some time ago I needed to take a look and I also found it being a bit annoying, also other related logs like apt or aptitude are world readable. But you are right about the adm group, and fixing this implies changing the group to root as well. > On the other hand, I don't see any obvious security concern by giving read > rights to this file except maybe for attacks that involve some precise > timing wrt dpkg operations. I don't know if that's enough to warrant the > restricted rights. I don't see any such attack being possible, the user would need higher privileges anyway, and you can already mointor what's going on in the file syste, with stuff like inotify. In case that kind of attack would be possible, the code is already vulnerable anyway, and it should be fixed instead. I've a local fix, which I'm thinking to push in few days if no one has strong objections? regards, guillem -- To UNSUBSCRIBE, email to [email protected] with a subject of "unsubscribe". Trouble? Contact [email protected]
