Path: utzoo!utgpu!news-server.csri.toronto.edu!cs.utexas.edu!usc!zaphod.mps.ohio-state.edu!lavaca.uh.edu!menudo.uh.edu!sugar!ficc!peter From: peter@ficc.ferranti.com (Peter da Silva) Newsgroups: comp.unix.internals Subject: Re: non-superuser chown(2)s considered harmful Keywords: chown security quota BSD SYSV Message-ID: Date: 7 Dec 90 22:58:31 GMT References: <1990Dec5.135759.12508@noao.edu> <1990Dec6.005358.6336@dg-rtp.dg.com> <109958@convex.convex.com> Reply-To: peter@ficc.ferranti.com (Peter da Silva) Organization: Xenix Support, FICC Lines: 11 In article <109958@convex.convex.com> tchrist@convex.COM (Tom Christiansen) writes: > If I make a /tmp/.exrc, and someone cd's to /tmp and vi's some file there, > I still won't trick someone into sourcing it because I can't make them own > it. Sounds like a bug in 'vi'. It really shouldn't source anything but ~/.exrc or (even better) run $EXINIT: you can put all your .exrc munging in there. Programs that build in a security hole then try to patch it over are far worse than a well-documented system call. As for quotas: disable the call if you're running quotas, otherwise leave it alone. -- Peter da Silva. `-_-' +1 713 274 5180. 'U` peter@ferranti.com