Re: [VulnDiscuss] Re: Dangerous permissions in unitedlinux

On Mon, 7 Apr 2003 22:15:02 +0200 (MEST)
Roman Drahtmueller <[email protected]> wrote:

<snip>
> beta after the product has been released. But anyway: The final
> UnitedLinux 1.0 products contain the same setup: All directories
> within/usr/src/packages are world-writeable with the t-flag set (mode
> 1777).
> 
> The modes have been set like this intentionally to make it possible
> for a non-root user to (re)build packages using the command
> 'rpm --rebuild package.spm'. By consequence, this is a tradeoff:
> Either you don't provide the modes necessary for non-root package
> builds, or you take the risk that somebody plants an egg in those
> directories.


I'm not fully aware of the UnitedLinux set-up, nor have I installed it
(or intend to), however... I (personaly) find this a very strange set-up
for a contempory Linux distro. 

I understand (and can read) that you want to allow non-root to be able
to build packages, but there are many other ways to do this without the
possiblity of courption/backdoors/trojons/ etc. in the packages. If
UnitedLinux is targeting the single user (like Windows9x) it starts to
make more sense (as far as easy of use) but I can not see any other
reason. 

Would it not be better and more secure to allow full access to a user
group with read permission for everyone?  Having a trusted user group
with full access would seem like a much more secure method for doing
this. 

Everyday users would/could still be able build packages and even install
from /usr/src/packages so long as a few (new) environment vars where
set-up and the package build system could read them or a command line
switch was passed to the package build application. The new vars could
be as simple as $USRBUILD, $USRDOC and $USRBIN. This would build
packages into ~/packages/$packagename/ and then install into ~/docs/ and
~/bin/. A set-up like this will still allows full control to the trusted
group and knownledge that the MD5 files and Makefiles of
/usr/src/packages have not been courpted by everyday users (or a simple
rm -rf /usr/src/packages has not been performed)

-Tig

<snip>