Re: Behavior of mdadm depending on user
From: Michael Schwarz <hidden>
Date: 2007-07-03 16:53:15
From: Michael Schwarz <hidden>
Date: 2007-07-03 16:53:15
The problem with that approach is that it opens up the applications in question to *any parameters* unlike the setuid C program which hardcodes the parameters to the commands. There is still a risk the binary may be modified, but it is lower than the risk an attacker might be able to execute arbitrary "mdadm" and "mount/umount" commands using sudo. -- Michael Schwarz
This isn't really an answer to your question, but isn't this an ideal application for sudo? Make a shell script with the mdadm command(s) you want. And set it up so apache or whatever your web server runs as able to run your shell script as root without authentication. Ian -- Ian Dall [off-list ref]