Re: USB Port Auto Notification to BitPim

Joe Pham wrote:
> This is for one BitPim process to notify another BitPim process 
> within the same host, so I don't think any authentication is 
> required.  

So that means *any* other local process can notify the BitPim process? 
Which means an external attacker just has to compromise the web server 
and then they've got access to BitPim?

 > Any specific security issues (probably on the server side)
> do you have in mind?

Generally this is done using private named pipes.  It is also the case 
that the user may have multiple BitPim sessions open (eg one on the 
console and another via a VNC session).  Typically environment variables 
are used with a notifier run in a child process picking the environment 
variable to get the pipe name.

> Hotplug would call a script (usbcell), which then calls BitPim to 
> notify BitPim of the changes.

The problem is that usbcell is going to run as root.  How on earth would 
it find one (or more) BitPim processes to prod?  Howe are you going to 
make sure it clobbers the right process or writes to the right file?

As an alternative you may want to use the dnotify extension instead 
listening on /dev and /proc/bus/usb.  It doesn't specifically matter 
which device is new - just have comscan/usbscan look for all devices.

Roger

-------------------------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642