* Wolfram Schlich <[EMAIL PROTECTED]> [2007-11-27 02:31]: > * Wolfram Schlich <[EMAIL PROTECTED]> [2007-11-27 02:24]: > > * Hanno Böck <[EMAIL PROTECTED]> [2007-11-26 15:39]: > > > [...] > > > So I'd like to unmask it soon. Please, if you're using mailman test it, > > > tell > > > me if it suits your needs or just give me feedback like "worksforme", I > > > actually don't have a clue how many people really use this ebuild. > > > > I get this using hardened-sources with activated grsecurity > > trusted path execution feature: > > > > 2007-11-27 02:15:47 +01:00; alpha; kern.alert; kernel: grsec: From > > 127.0.0.6: \ > > denied untrusted exec of /usr/lib/mailman/bin/mmsitepass by \ > > /bin/bash[bash:14178] uid/euid:280/280 gid/egid:280/280, \ > > parent /bin/bash[bash:14173] uid/euid:280/280 gid/egid:280/280 > > > > That's because /usr/lib/mailman/bin/ is group-writable. > > Ok, that's not true :] > > Using this configuration... > --8<-- > CONFIG_GRKERNSEC_TPE=y > # CONFIG_GRKERNSEC_TPE_ALL is not set > CONFIG_GRKERNSEC_TPE_INVERT=y > CONFIG_GRKERNSEC_TPE_GID=1005 > --8<-- > ...I have to add 'mailman' to group 1005.
Ok, it get's worse: for the mailman webinterface, I'd have to add 'apache' to group 1005 as well, opening up even bigger holes. No way! So, emerge -C mailman, that is :( Too bad. -- Regards, Wolfram Schlich <[EMAIL PROTECTED]> Gentoo Linux * http://dev.gentoo.org/~wschlich/ -- [EMAIL PROTECTED] mailing list
