Author: mwiegand
Date: 2008-09-25 11:10:36 +0200 (Thu, 25 Sep 2008)
New Revision: 1428
Modified:
trunk/openvas-server/ChangeLog
trunk/openvas-server/openvasd/oval_plugins.c
Log:
* openvasd/oval_plugins.c: Added notice regarding running ovaldi with
reduced privileges.
Modified: trunk/openvas-server/ChangeLog
===================================================================
--- trunk/openvas-server/ChangeLog 2008-09-25 08:46:29 UTC (rev 1427)
+++ trunk/openvas-server/ChangeLog 2008-09-25 09:10:36 UTC (rev 1428)
@@ -1,3 +1,8 @@
+2008-09-25 Michael Wiegand <[EMAIL PROTECTED]>
+
+ * openvasd/oval_plugins.c: Added notice regarding running ovaldi with
+ reduced privileges.
+
2008-09-23 Jan-Oliver Wagner <[EMAIL PROTECTED]>
* openvasd/comm.c (comm_init): Removed setting of scan_ids
Modified: trunk/openvas-server/openvasd/oval_plugins.c
===================================================================
--- trunk/openvas-server/openvasd/oval_plugins.c 2008-09-25 08:46:29 UTC
(rev 1427)
+++ trunk/openvas-server/openvasd/oval_plugins.c 2008-09-25 09:10:36 UTC
(rev 1428)
@@ -53,6 +53,14 @@
gboolean in_results_definition = FALSE;
gchar * result;
+void child_setup (gpointer user_data) {
+ // TODO: ovaldi should run with as few privileges as possible. To do this,
this
+ // setup function for the ovaldi child, which will be called between fork()
+ // and exec(), should setuid to a configurable, non-privileged user. This
user
+ // has to be able to read the SC file and the selected definitions and to
+ // write to /tmp/.
+}
+
void start_element (GMarkupParseContext *context, const gchar *element_name,
const gchar **attribute_names,
const gchar **attribute_values, gpointer user_data,
@@ -418,7 +426,7 @@
argv[8] = NULL;
// log_write("Launching ovaldi with: %s\n", g_strjoinv(" ", argv));
- if(g_spawn_sync(NULL, argv, NULL, 0, NULL, NULL, NULL, NULL, NULL, NULL))
+ if(g_spawn_sync(NULL, argv, NULL, 0, child_setup, NULL, NULL, NULL, NULL,
NULL))
{
GMarkupParser parser;
GMarkupParseContext *context = NULL;
_______________________________________________
Openvas-commits mailing list
[email protected]
http://lists.wald.intevation.org/mailman/listinfo/openvas-commits
