Relay-Version: version B 2.10 5/3/83; site utzoo.UUCP
Posting-Version: version B 2.10.3 4.3bsd-beta 6/6/85; site ucbvax.BERKELEY.EDU
Path: utzoo!decvax!ittatc!dcdwest!sdcsvax!ucbvax!info-vax
From: info-vax@ucbvax.UUCP
Newsgroups: mod.computers.vax
Subject: DISKQUOTA protections on VMS 4.n
Message-ID: <8602111901.AA17135@seismo.CSS.GOV>
Date: Mon, 10-Feb-86 12:01:59 EST
Article-I.D.: seismo.8602111901.AA17135
Posted: Mon Feb 10 12:01:59 1986
Date-Received: Sat, 15-Feb-86 10:41:53 EST
Sender: daemon@ucbvax.BERKELEY.EDU
Reply-To: yetti!oz@seismo.CSS.GOV (Ozan Yigit)
Organization: York U. Computer Science
Lines: 19
Keywords: diskquota, protections
Approved: info-vax@sri-kl.arpa

We discovered that VMS V4.n install procedure gives execute permissions
to the world while installing diskquota. If you are an educational site
(i.e. lotsa student hackers) and your diskspace is dissapearing to the
void, this may be the reason. Since diskquota is installed w. SYSPRIV,
anybody can change their own quotas. (Our local VMSnauts conjecture
that this is done by DEC purposefully to sell more disks :-)

In our case, we discovered this with the help of a friendly hacker, and
it really did not occur to us to check. (gulp!)

Perhaps VMS install should be bit more verbose about the protections
and priviledges it sets up, as opposed to just rumbling like a lunatic.

Oz
-------
Usenet: [decvax|allegra|linus|ihnp4]!utzoo!yetti!oz
Bitnet: oz@[yusol|yuyetti]
	FREE SOFTWARE FOUNDATION vs. EMPIRE. Watch for
	things to come..