Re: compile-time configuration, etc.

Stefan Karrmann <[email protected]> wrote:
> E.g.: Suppose Eve creates package 'trojan' such that it contains
>    /etc/inetd.conf and /etc/passwd. After unpacking it in / she may enter
>    the local system from remote computers. If unpacking is confined to
>    <.../package> and <.../src> this is not possible.

Restricting the unpacked files to the package directory is sufficient
to stop that attack.

>    Also Fool's package may overwrite <.../conf/individual-edited>, etc.

I assume you're talking about configuration files in the same package,
not in a different package.  sp-install is not intended to solve that
problem.  sp-install is intended to make it easy to work with packages
that choose to conform to the standard slashpackage conventions - not
to enforce those conventions on all packages.


paul