Re: Bug#286040: please allow permissions.d to follow symlinks

[martin f krafft <madduck@madduck.net>]

[-- Attachment #1: Type: text/plain, Size: 1901 bytes --]

also sprach Greg KH <greg@kroah.com> [2004.12.17.1745 +0100]:
> I think Kay properly stated my argument already.  I'll leave it at
> that for now, as he has done a wonderful job so far.

mh. I must work on improving my English comprehension skills then.

> Actually I was considering just dropping the permissions.d file
> entirely, as I think we don't need it anymore.  But I have not had
> the time to determine if this is possible or not just yet.

Oh great. Reverse evolution.

> What about the fun interaction with pam that causes device nodes to
> "magically" assume other permissions.  Are you objecting to that too?

Yes, vehemently. It has caused way too much trouble.

From the README:

  "Please note: the current version depends on too many external
  tools and libraries, making it big and hard to evaluate for
  security."

http://www.i-eye.net/exploits/pam_console.c.php

It may work for your one-user desktop system. Any other use is
dangerous. There must be a reason why it's not part of libpam.

> I have yet to see a patch that offers such an "improvement" in
> this thread.  If you ever create one, I would love to see it
> posted on the list for everyone to evaluate.  Until then, this
> argument is over.

I might provide it. However, so far the feedback has been that
I should instead bugger off and get a clue. So instead I think
I will feed it into Debian and see if it's useful. You can always
come and ask for it should I forget to submit it here.

-- 
martin;              (greetings from the heart of the sun.)
  \____ echo mailto: !#^."<*>"|tr "<*> mailto:" net@madduck
 
invalid/expired pgp subkeys? use subkeys.pgp.net as keyserver!
spamtraps: madduck.bogus@madduck.net
 
"in the stage of grand illusion
 you walked into my life
 out of my dreams."
                                                        -- david bowie

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 189 bytes --]