Thread (4 messages) 4 messages, 3 authors, 2007-07-03

Re: Behavior of mdadm depending on user

From: Michael Schwarz <hidden>
Date: 2007-07-03 16:53:15

The problem with that approach is that it opens up the applications in
question to *any parameters* unlike the setuid C program which hardcodes the
parameters to the commands.

There is still a risk the binary may be modified, but it is lower than the
risk an attacker might be able to execute arbitrary "mdadm" and "mount/umount"
commands using sudo.

-- 
Michael Schwarz
This isn't really an answer to your question, but isn't this an ideal
application for sudo? Make a shell script with the mdadm command(s) you
want. And set it up so apache or whatever your web server runs as able
to run your shell script as root without authentication.

Ian
--
Ian Dall [off-list ref]
  
Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help