|
| From: [EMAIL PROTECTED]
| Subject: Re: Installing MC at your ISP, a "How-To"
snip
|
| And
| if you launched it as a user with admin privileges, cross your
| fingers.
Sir,
Isn't this highly unlikely, that an ISP would grant regular users any
kind of admin privileges? No wrapper is required to set the umask so
that users can only modify things in their own home directory or below.
See excerpt from a Unix man page on umask below. If ISP's don't take at
least this extremely elementary precaution (which is probably the default
installation for most Unix systems) they are asking for trouble from
any kind of cgi activity. I think that admin privileges for regular
users must be an extremely remote potential, although, yes, it could
be possible.
When so many people were all hyped up about potential disasters prior to
Y2K I used to tell them .. yeah, its *possible* but its also *possible*
the gasoline in your car's tank could explode. No one seems worried
about that.
I think the potential of dangerous activity here is being somewhat
overhyped. Can't users who install MC on their ISP take simple
precautions like, set permissions on the mc file so it is owned and
can only be operated by themselves, check the referrer in their MC cgi
scripts etc?
Regards,
Sadhu
umask(1) umask(1)
NAME
umask - set or display the file mode creation mask
SYNOPSIS
Set Mask
umask mask
Display Mask
umask [-S]
DESCRIPTION
The umask command sets the value of the file mode creation mask or
displays the current one. The mask affects the initial value of the
file mode (permission) bits for subsequently created files.
Archives: http://www.mail-archive.com/[email protected]/
Info: http://www.xworlds.com/metacard/mailinglist.htm
Please send bug reports to <[EMAIL PROTECTED]>, not this list.
