Re: [Security-Discuss] Xine accessing /etc/passwd ????

Le dimanche 21 mai 2006 à 09:36 -0400, Tuxiq a écrit :
> 	OK guys this is my first post so I apologize in advance for any mistakes...
> 
> I noticed my latest XINE, when started from a konsole and provided with a 
> filename on the command line, suddenly started giving me the following 
> message when exiting ....
> 
> 	mkdir(/spook) failed: Permission denied
> 
> where "spook" is my normal user name. So I was curious and did an STRACE of 
> xine which revealed that something in the process was accessing 
> the /etc/passwd file and looking up the <root> entry !!?????
> 
> IS THIS NORMAL BEHAVIOUR???????

can you please avoid overreacting ( ie no caps, no '!!!' and '???' ) ?

if you use strace, you will see that ls and most process actually
read /etc/passwd to have information like the username, the group, etc
etc. And so does xine.

This is a normal behavior.

And, the file /etc/passwd is world readable because it no longer contain
anything sensitive since years.
The hash of the password is in /etc/shadow, as explained on almost unix
tutorial on the subject.

> 
> In any case I am attaching the strace output.
> 
> OH and while I'm at it, 
> 	while preparing the attachment I managed to delete a file belonging to 
> root:root with only READ access writes to group members or others, and this 
> is not the first time the system allowed me to do this. The only  possible 
> mitigating factor is that it happened in my home directory and my user has 
> full sudo rights but I had not even invoked sudo in that session so there was 
> no possibility of "RESIDUAL" rights from a prior invocation. 


____________________________________________________
Want to buy your Pack or Services from Mandriva? 
Go to http://store.mandriva.com
Join the Club : http://www.mandrivaclub.com
____________________________________________________