Re: Bug#27050 (fdutils): A cause for security concern?

[dichro-f9318705@eris.rcpt.to (Mikolaj J. Habryn)]

>>>>> "AF" == Anthony Fok <foka@ualberta.ca> writes:

    AF>     if (geteuid()!=0) die("Must run with EUID=root");

    AF> I am a little bit tempted to comment that line out, but it's
    AF> probably there for a reason, and I am definitely not qualified
    AF> to hack fdmount.c, so for now I should probably add a
    AF> /usr/sbin/fdutilsconfig as Thomas has suggested.

  This sort of thing should be shot on sight. It will need to be
removed one way or another when we move to a capability based
system. The downside is that the reason things like this exist is the
complete lack of any error handling in the rest of the code.

  If you need something to do, dike it out. If it's run as root, it
will work as expected. If not, then it can't do any real damage,
right? ;)

m.