Am 19.03.2013 23:00, schrieb Joachim Metz: > Pyinstaller now seems to have a restriction that it cannot run under root. > "You are running PyInstaller as user root." > > 1. Can you elaborate what reason for this restriction is? And why this > only done for "Unix" not for OSX or Windows?
a) PyInstaller does path-manipulation, imports hook-files and other stuff which can be changed by users. This would allow attackers to delete you whole file-system by injecting a malicious module. b) There is no need for running PyInstaller as root. c) Root is the super user. One ought not use it for building software. > 2. This check is also triggered when running under fakeroot > e.g. from dpkg-buildpackage -r fakeroot > > Can you add a flag to override this behavior or fix the detection for > root under fakeroot? No, this would contradict the security measure. -- Schönen Gruß Hartmut Goebel Dipl.-Informatiker (univ), CISSP, CSSLP Goebel Consult http://www.goebel-consult.de Monatliche Kolumne: http://www.cissp-gefluester.de/2012-09-steht-ein-manta-fahrer-vor-der-uni Blog: http://www.goebel-consult.de/blog/20050620 Goebel Consult ist Mitglied bei http://www.7-it.de/
smime.p7s
Description: S/MIME Kryptografische Unterschrift
