On Jan 17, Pat Moffitt wrote: > > Some of the recent upgrades have the executables set UID=0 where they were > not in the past. This includes (but may not be limited to) the following: > > at > smbmnt > smbmount > smbumount > > Do these really need to be set UID=0? Is this a security concern? > I don't know about 'at' (I don't have it installed) however it seems useful for me to have those smb* packages UID=0. It allows the lusers to mount remote samba shares without having to beg the sysadmin to do it for them or add them to a sudoers file. I would imagine that the people who throw together the smbmount package know what they are doing and have considered the security implications and decided that there are none.
Personnaly I would leave them UID=0 as I find it invalable, however you may
not want lusers to smbmount shares, if this is the case remove the package
(if you also don't use it) or remove the UID=0 feature.
Alex
--
_________________________________________
/ You have all eternity to be cautious in \
| when you're dead. |
| |
\ -- Lois Platford /
-----------------------------------------
\ ^__^
\ (oo)\_______
(__)\ )\/\
||----w |
|| ||
msg05367/pgp00000.pgp
Description: PGP signature
