Subject: Re: Helping Out
From: jeff (jeff@univrel.pr.uconn.edu)
Date: Tue Feb 27 2001 - 15:46:08 EST
"Marc J. Miller" wrote:
> >What's Dropkludge? I assume it is some kludge to mimic the
> >AppleShare Server "drop box" world write/owner rwx thingee.
>
> That's how it started... I eventually discovered that the same permission
> handling that was preventing Dropboxes from working was also creating other
> bugs. So I made the changes universal. It not only maintains rwx
> permissions, but it also makes sure that every file created within a
> directory has the same owner and group as the directory itself. That's
> what Mac expects. Unfortunately, I've run into a couple of difficulties --
> a known security hole which is extremely well-documented on Sourceforge
> (check the DocManager) and a difficulty that when someone drops a folder
> into a dropbox, the dropped folder also becomes a dropbox, owned by whoever
> dropped it there. That's related to the setgid being set on the dropbox
> and permission inheritance.
Sorry about the lateness of this email.
Are you saying that there are security problems inherant in matching
file permissions to directory permissions, or that there specifically a
problem with matching file permissions to directory permissions where
they are world accessable ... ?
I only ask because I was looking at making dropkludge available by
share, which may be a good idea, but also may still pose a security
concern. What's your opinion on that?
--SNIP--
> We have a TODO list in the CVS. That seems like a good starting point...
> perhaps someone (Jeff?!) could update the bug tracker with some of the info
> there and decide what bugs are critical, what bugs could wait for now, etc.
I've been running through the bugs list, patching the ones I can, and
marking down the ones for 1.4b2 and other older versions.
If anyone else would like to help me run through the bugs list, it would
be much appreciated.
jeff
(as usual, with tremendous apologies for the cross-posting)
This archive was generated by hypermail 2b28 : Sun Oct 14 2001 - 03:04:33 EDT