Subject: Bug#3189: nvi over-cautious about .exrc?

From: [email-masked] (Bruce Perens)
Date: Sun, 2 Jun 96 19:03 PDT

I think that's prudent. It would be simple enough to stick a trojan
horse in the .exrc .

	Bruce
--
Pixar's Toy Story: Over 1/3 Billion dollars world box office so far.

Bruce Perens AB6YM          [email-masked]            http://www.hams.com/

---

From: Steve Greenland <[email-masked]>
Date: Mon, 3 Jun 1996 09:43:05 -0500 (CDT)

> I think that's prudent. It would be simple enough to stick a trojan

It would be possible to check if the owner and the group were the
same, and allow mode 664 if that were the case. Is that sufficient,
and is it worth doing? (What's the advantage of umask=002?)

Steve Greenland

--
The Mole - I think, therefore I scream

			"Pesky foreign espionage agents!  Why don't they let
			 me be?"
[Lester Girls, lamenting on the lot of the Secret Agent]

---

From: Ian Jackson <[email-masked]>
Date: Tue, 4 Jun 96 03:31 BST

> I think that's prudent. It would be simple enough to stick a trojan

I disagree, strongly.

It is not the business of programs to check the permissions of the
dotfiles in users' home directories.

Firstly, this means that they are deciding my security policy for me,
which is not appropriate.  (And, as we see, it is causing problems
because Debian's default security policy and architecture is not
compatible with its ideas.)

Secondly, it is futile.  For every program which does this check there
will be dozens which don't; if someone has the opportunity to attack
these files they'll just do it to one of the other ones.

Ian.

---

From: Oliver Oberdorf <[email-masked]>
Date: Tue, 04 Jun 1996 08:30:10 -0400

Bill Mitchell
> On Tue, 4 Jun 1996, Ian Jackson wrote:
>
> I agree.  I chased my tail for quite a while some time back because of
> what I recall as procmail's concern over the permissions on my .forward
> file.  It didn't complain, it just didn't work as I expected from reading
> the docs.

But for a large system with many users (of varying levels of clue) it
is very beneficial for the SysAdmin that a user can't accidentally create
a writeable .forward file.  With a large enough system, a hacker could
just look for a writeable .forward and, statistically, be fairly sure to
find one.

I think /some/ apps need to check permissions to prevent inevitable security 
holes from popping up.  Ideally, those permission requirements should be

1. minimal - i.e. "no write access for group/other on .forward"

and

2. well documented

This may not be important for nvi, though I think it is, but it is clear
to me that it *is* the business of some programs to check permissions.
Not all Debian users will be as smart as Debian installers/admins.

-Oly

---

From: Bill Mitchell <[email-masked]>
Date: Mon, 3 Jun 1996 22:42:15 -0700 (PDT)