Re: syslogd(8) Dropping Privs

From: Colin Percival (colin.percival_at_wadham.ox.ac.uk)
Date: 06/05/04

  • Next message: Darren Reed: "Re: syslogd(8) Dropping Privs" 
    Date: Fri, 04 Jun 2004 23:57:51 +0100
To: "Crist J. Clark" <cjc@freebsd.org>

    At 20:53 04/06/2004, Crist J. Clark wrote:
    >We haven't had many syslogd(8) vulnerabilities lately, but one
    >less daemon running as root seems like a Good Thing. I do not
    >see any drawbacks from a security point of view. The log files
    >would have to be owned, or otherwise writeable, by this other
    >user, but so what. Obviously, I may be missing something.

      One consideration is that if syslogd is not running as root,
    it will no longer be able to write to a filesystem which is
    already "full".
      On systems where non-root users can write to the filesystem
    containing /var/log (and are not limited by quotas) this would
    allow non-root users to disable logging, which would probably
    be a Bad Thing.

    Colin Percival

    _______________________________________________
    freebsd-security@freebsd.org mailing list
    http://lists.freebsd.org/mailman/listinfo/freebsd-security
    To unsubscribe, send any mail to "freebsd-security-unsubscribe@freebsd.org"

  • Next message: Darren Reed: "Re: syslogd(8) Dropping Privs"

    Relevant Pages

    • Re: syslogd(8) Dropping Privs
      ... >>less daemon running as root seems like a Good Thing. ... > it will no longer be able to write to a filesystem which is ... syslogd with disk space. ...
      (FreeBSD-Security)
    • Re: nologin files and non-root user access
      ... non-root users are allowed to log on. ... made a point that root access should be restricted. ... administrators to have root access. ... users from logging on until the administrator says its okay. ...
      (comp.unix.aix)
    • Re: nologin files and non-root user access
      ... non-root users are allowed to log on. ... made a point that root access should be restricted. ... administrators to have root access. ... users from logging on until the administrator says its okay. ...
      (comp.unix.aix)
    • nologin files and non-root user access
      ... non-root users are allowed to log on. ... made a point that root access should be restricted. ... administrators to have root access. ... users from logging on until the administrator says its okay. ...
      (comp.unix.aix)
    • Re: Running one Python program from another as a different user
      ... I have a daemon running as root and I want to ... > execute another Python program as another user. ... > the launched program is graphical in nature, ...
      (comp.lang.python)