About this list Date view Thread view Subject view Author view Attachment view

From: Enrico Scholz (enrico.scholz_at_sigma-chemnitz.de)
Date: Tue 09 Aug 2005 - 08:20:15 BST


eyck_at_ghost.anime.pl ("Dariush Pietrzak,,,") writes:

>> legacy configuration does not have a big future and *would*
>> need security fixes first, this has a very low priority.
> What security fixes?

Oh... where shall I begin? Basically, the filesystem operations
are full of races and contain enough opportunities for symlink
attacks. Fixes would need the redesign of large parts of the
legacy tools. The non-legacy part of util-vserver is the result of
this redesign and I am sure that symlink attacks are impossible
and races were eliminitated there ;)

(The 'initpost' script of RH style vservers is an exception...)

Enrico


_______________________________________________
Vserver mailing list
Vserver_at_list.linux-vserver.org
http://list.linux-vserver.org/mailman/listinfo/vserver


About this list Date view Thread view Subject view Author view Attachment view
[Next/Previous Months] [Main vserver Project Homepage] [Howto Subscribe/Unsubscribe] [Paul Sladen's vserver stuff]
Generated on Tue 09 Aug 2005 - 08:20:51 BST by hypermail 2.1.3