Re: NACK NACK! [PATCH] Add two new fourcc codes for 16bpp formats

[Michael Krufky <mkrufky@linuxtv.org>]

Brandon Philips wrote:
> On 12:01 Tue 05 Feb 2008, Mauro Carvalho Chehab wrote:
>> On Tue, 05 Feb 2008 08:23:28 -0500
>> Michael Krufky <mkrufky@linuxtv.org> wrote:
>>
>>> Brandon Philips wrote:
>>>> - mailimport changes in this commit too!  Why is mailimport running
>>>>   sudo!?! 
>>> I understand that unrelated changes were accidentally merged with a single commit, but why would we want this script to call sudo in the first place?
>>>
>>> I think it's bad practice, for such a script to execute commands as root -- 
>>>
>>> Can you explain, Mauro?
>> The script itself doesn't open any new vulnerabilities. Sudo only works if 
>> configured at /etc/sudoers.
> 
> I don't use the script but I would certainly remove the sudo calls in my
> local version if I started to.  A patch tool really shouldn't need sudo.
> If the perms are wrong the user can write a wrapper script to fix them.
> 
>> 2) the user of the second account types his password (or, otherwise, sudo is
>> configured to not ask for passwords - on very weak environments).
> 
> sudo defaults to a 15 grace period where it doesn't ask for a password
> again.


I agree with Brandon -- I think the use of sudo here is entirely inappropriate, and there are clearly other ways that a user can address file ownership / permissions issues without this.

-Mike

--
video4linux-list mailing list
Unsubscribe mailto:video4linux-list-request@redhat.com?subject=unsubscribe
https://www.redhat.com/mailman/listinfo/video4linux-list