Re: libclamav versus clamd

Andreas writes:
> On Tue, Jun 01, 2004 at 04:05:35AM +1200, Jason Haar wrote:
> > What's wrong with running clamd as root? I mean, assuming there are no
> > exploitable holes in clamd, then what other problems are there?
> 
> Does it need to run as root?
> If there is a security problem, then why make it a remote-root vulnerability?

If it has to scan ALL the files, yes, it has to be root.

If it has to scan only the files that belong to one user, 
then it can run under that user's account.

If it has to run under the accounts of each user in turn, then yes, 
it has to be root, at least to setuid (the subprocess that is doing
the actual scanning can be run under that user's account).

Note that the directory hierarchy may contain traps that prevent a
user to access files that belong to him.  You need to be root to scan
them!

mkdir /tmp/dir
touch /tmp/dir/file
chown user1 /tmp/dir/file
chmod 600   /tmp/dir/file
chown user2 /tmp/dir
chmod 700   /tmp/dir

user1 cannot access his file /tmp/dir/file anymore!
user2 cannot access user1's file either.

But user2 could give a suid program to allow user1 to access the
closed box (/tmp/dir) and the file that belongs to user1. (That's why
such access right structures could be useful and thus are not
prevented by the system).


See also the various kind of drop-box, ftp incoming directories, etc.



-- 
__Pascal_Bourguignon__                     http://www.informatimago.com/
There is no worse tyranny than to force a man to pay for what he doesn't
want merely because you think it would be good for him.--Robert Heinlein
http://www.theadvocates.org/


-------------------------------------------------------
This SF.Net email is sponsored by the new InstallShield X.
From Windows to Linux, servers to mobile, InstallShield X is the one
installation-authoring solution that does it all. Learn more and
evaluate today! http://www.installshield.com/Dev2Dev/0504