Re: Environment Poisoning and login -p

From: Dag-Erling Smørgrav (des_at_des.no)
Date: 02/27/04

  • Next message: Cy Schubert: "MIT Krb5 Port Upgrade" 
    To: "Jacques A. Vidrine" <nectar@FreeBSD.org>
Date: Fri, 27 Feb 2004 13:33:25 +0100

    "Jacques A. Vidrine" <nectar@FreeBSD.org> writes:
    > On Fri, Feb 27, 2004 at 02:27:00PM +0300, Andrey Chernov wrote:
    > > On Fri, Feb 27, 2004 at 05:13:53AM -0600, D J Hawkey Jr wrote:
    > > > > Instead, I've decided to follow Jacques Vidrine's
    > > > > suggestion of using a whitelist of environment variables
    > > > > that are "known-safe."
    > > > Coming in from left field... Will there be some sort of mechanism for
    > > > an admin to set/modify this list?
    > > I agree we'll need it (because of different assumptions). Something like
    > > /etc/safe_environment file.
    > Whoa, Let's not complicate things unnecessarily.

    Agreed, let's let this discussion die instead. login(1) is no longer
    setuid root, so the whole thing is a non-issue.

    DES 

    -- 
Dag-Erling Smørgrav - des@des.no
_______________________________________________
freebsd-security@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-security
To unsubscribe, send any mail to "freebsd-security-unsubscribe@freebsd.org"
  • Next message: Cy Schubert: "MIT Krb5 Port Upgrade"

    Relevant Pages