Xref: utzoo alt.security:1599 alt.bbs:3009 comp.unix.sysv386:586
Path: utzoo!utgpu!cs.utexas.edu!sun-barr!apple!olivea!orc!inews!iwarp.intel.com!gargoyle!chinet!les
From: les@chinet.chi.il.us (Leslie Mikesell)
Newsgroups: alt.security,alt.bbs,comp.unix.sysv386
Subject: Re: Protecting against downloads
Message-ID: <1990Sep22.024446.3305@chinet.chi.il.us>
Date: 22 Sep 90 02:44:46 GMT
References: <2441@sud509.ed.ray.com> <1990S <1990Sep20.153105.28394@naitc.naitc.com>
Organization: Chinet - Chicago Public Access UNIX
Lines: 21

In article <1990Sep20.153105.28394@naitc.naitc.com> karl@bbs.naitc.com (Karl Denninger) writes:

>I hope you don't allow "vi" access, or you have the bbs in a "chroot"ed area
>with no backlinked files (ie: no linked files between the areas).

What is the danger of linked files if the users don't have write permssion
to any of them?  It takes a non-trivial amount of baggage to make vi
happy (at least on modern SysV it wants the shared libs, all of
/usr/lib/terminfo/*/*, TMPDIR, plus the shell and whatever tools you
need for paragraph reformatting, sorting and the like).  Too bad we
don't have read-only symlinks.

>Without source code to "vi" there is NO WAY to prevent this.  Believe me.  
>I had this rather graphically illustrated to me once; it's a flaw in the
>way vi works.

Actually it's a feature of the way unix works - all the tools expect to
be able to include all the others. 

Les Mikesell
  les@chinet.chi.il.us