Skip to content
Snippets Groups Projects
  1. Sep 09, 2003
  2. Sep 05, 2003
  3. Sep 04, 2003
  4. Sep 02, 2003
    • deuce's avatar
      Linux will now (sort of) run as a non-root user. After hours of trying · 772ac0b2
      deuce authored
      to track down the issue, I finally gave up... as a result, there is a new
      feature!
      
      Linux will no longer completely drop it's root privs (It never really did
      anyways, and you couldn't possibly make it... but now it does so even less)
      
      As a result, Linux can now recycle all servers when running as non-root.
      
      From a security standpoint, doing this is more secure than running as root,
      but less secure than the behaviour on POSIX.4 compliant pthreads.  Running
      the BBS as root means that if a user can create a file with the name of his
      choice, or pass *any* command through to a shell, that user will get root
      access to the machine.  Using the new behaviour, the user would need to
      trick the Synchronet binary itself into executing arbitrary and specially
      crafted code... probobly using the dreaded buffer overflow... of which
      there are probobly some in the web server code.  :-)  If the user can do
      this much more tricky feat, then the user gets root privs.  If not, the
      user will have to find something else to exploit on your system.
      
      Knowing that some *BSD users (surely not OpenBSD users though) will want to
      trade security for convenience, I stole a page out of the Sendmail book and
      implemented a "DONT_BLAME_SYNCHRONET" make option.  Compiling like this:
      gmake DONT_BLAME_SYNCHRONET=1
      
      Will implement this same behaviour on non-Linux platforms.  Allowing this
      partial security feature.
      772ac0b2
  5. Aug 30, 2003
  6. Aug 20, 2003
  7. Aug 12, 2003
  8. Jul 30, 2003
  9. Jul 25, 2003
  10. Jul 21, 2003
  11. Jul 13, 2003
  12. Jul 12, 2003
  13. Jul 10, 2003
  14. Jul 09, 2003
  15. Jun 13, 2003
  16. Jun 12, 2003
  17. Jun 07, 2003
  18. May 17, 2003
  19. May 09, 2003
  20. May 07, 2003
  21. Apr 30, 2003
  22. Apr 29, 2003
  23. Apr 28, 2003
  24. Apr 14, 2003
  25. Apr 09, 2003
Loading