Path: utzoo!yunexus!ists!mike
From: mike@ists (Mike Clarkson)
Newsgroups: comp.bugs.sys5
Subject: Re: A security hole
Summary: Use chron
Message-ID: <168@ists>
Date: 25 Mar 88 15:15:45 GMT
Article-I.D.: ists.168
Posted: Fri Mar 25 10:15:45 1988
References: <181@wsccs.UUCP> <722@rivm05.UUCP> <478@minya.UUCP> <7521@ncoast.UUCP> <130@heart-of-gold>
Organization: I.S.T.S.
Lines: 26

In article <130@heart-of-gold>, jc@heart-of-gold (John M Chambers x7780 1E342) writes:
> I do understand why I wouldn't want to turn off these setuid and setgid bits.
> In my experience, rnews is very often triggered by things (like cron) that
> are run by root, and I've seen a lot of problems caused by news files ending
> up owned by root rather than news.  I wouldn't trust news run by root, and I
> don't trust cron to correctly run things under other ids;  I've had too many
> surprises there to believe that I can reliably control cron.  So the setuid
> and setgid bits are needed to guarantee that cron can't start rnews up with
> root permissions.  This seems to me to restrict incoming news to only those
> directories with news write permissions.  If I'm wrong, I'd like to know, so
> I can start looking for other ways to do the job.

Use su in your crontab:

	0 * * * * su news -c "rnews -U"

Then rnews (or whatever command you like) will run as news, not root.
Also wise to do this with anything else you really don't need root to
be running: like uucico.


-- 
Mike Clarkson						mike@ists.UUCP
Institute for Space and Terrestrial Science
York University, North York, Ontario,
CANADA M3J 1P3						(416) 736-5611