TurboCASH to be open source

2006-01-19 Thread Ido Kanner
Hi list, TurboCASH is a program for accounting that exists for 18 years now, and written in Delphi. Recently the company has released the new version as a GPL based program, and released it's source to sf. It seems that the FreePascal community is going to take the source and convert it into

Re: TurboCASH to be open source

2006-01-19 Thread Tzafrir Cohen
On Thu, Jan 19, 2006 at 02:50:26PM +0200, Ido Kanner wrote: Hi list, TurboCASH is a program for accounting that exists for 18 years now, and written in Delphi. Recently the company has released the new version as a GPL based program, and released it's source to sf. As recent as in July

Security hole?

2006-01-19 Thread Efraim Yawitz
Hi, I was just wondering what could be done against the following seemingly huge security hole in Linux (or any Unix-type system). The system call mknod can only be used by root to make special device files, but once those files exist they can be copied by anyone. What is to

Re: Security hole?

2006-01-19 Thread Yedidyah Bar-David
On Thu, Jan 19, 2006 at 05:11:33PM +0200, Efraim Yawitz wrote: Hi, I was just wondering what could be done against the following seemingly huge security hole in Linux (or any Unix-type system). The system call mknod can only be used by root to make special device

Re: Security hole?

2006-01-19 Thread Tzafrir Cohen
On Thu, Jan 19, 2006 at 05:11:33PM +0200, Efraim Yawitz wrote: Hi, I was just wondering what could be done against the following seemingly huge security hole in Linux (or any Unix-type system). The system call mknod can only be used by root to make special device

Re: Security hole?

2006-01-19 Thread Geoffrey S. Mendelson
On Thu, Jan 19, 2006 at 05:11:33PM +0200, Efraim Yawitz wrote: The system call mknod can only be used by root to make special device files, but once those files exist they can be copied by anyone. What is to stop me from becoming root on my own machine and creating

Re: Security hole?

2006-01-19 Thread Efraim Yawitz
On Thu, 19 Jan 2006, Tzafrir Cohen wrote: You don't need to be root to create a tar file with device files in it. This is merely writing a tar file. You do need to be root (or otherwise priviliged) to mknod. Generating the device files as extracted from the tarball is the priviliged

Re: Security hole?

2006-01-19 Thread Efraim Yawitz
On Thu, 19 Jan 2006, Yedidyah Bar-David wrote: Just one more note - it's recommended, on multiuser machines, to mount any user-writable filesystems with '-o nodev' (among other things). This usually means having /var,/tmp,/home maybe others as independent filesystems. This is the thing I

Re: Security hole?

2006-01-19 Thread Gilboa Davara
On Thu, 2006-01-19 at 19:04 +0200, Efraim Yawitz wrote: On Thu, 19 Jan 2006, Tzafrir Cohen wrote: You don't need to be root to create a tar file with device files in it. This is merely writing a tar file. You do need to be root (or otherwise priviliged) to mknod. Generating the

Re: Security hole?

2006-01-19 Thread Tzafrir Cohen
On Thu, Jan 19, 2006 at 07:04:20PM +0200, Efraim Yawitz wrote: On Thu, 19 Jan 2006, Tzafrir Cohen wrote: You don't need to be root to create a tar file with device files in it. This is merely writing a tar file. You do need to be root (or otherwise priviliged) to mknod. Generating

Re: Security hole?

2006-01-19 Thread Efraim Yawitz
On Thu, 19 Jan 2006, Gilboa Davara wrote: Umm mounting loop device is limited to root for a good reason. Once a user had loop mount capability, it's much easier for him to mount a modified FS where all the sbin utilities are suided... A secure system gives users *very* limited mount

Re: Security hole?

2006-01-19 Thread Gilboa Davara
On Thu, 2006-01-19 at 21:08 +0200, Efraim Yawitz wrote: On Thu, 19 Jan 2006, Gilboa Davara wrote: Umm mounting loop device is limited to root for a good reason. Once a user had loop mount capability, it's much easier for him to mount a modified FS where all the sbin utilities are