Date: Wed, 23 May 2007 12:59:33 -0700 From: Alfred Perlstein <alfred@freebsd.org> To: Daniel Eischen <deischen@freebsd.org> Cc: Colin Percival <cperciva@freebsd.org>, "freebsd-arch@freebsd.org" <freebsd-arch@freebsd.org> Subject: Re: RFC: Removing file(1)+libmagic(3) from the base system Message-ID: <20070523195933.GM21795@elvis.mu.org> In-Reply-To: <Pine.GSO.4.64.0705231346400.9867@sea.ntplx.net> References: <46546E16.9070707@freebsd.org> <Pine.GSO.4.64.0705231346400.9867@sea.ntplx.net>
next in thread | previous in thread | raw e-mail | index | archive | help
* Daniel Eischen <deischen@freebsd.org> [070523 11:05] wrote: > On Wed, 23 May 2007, Colin Percival wrote: > > >FreeBSD architects and file(1) maintainer, > > > >I'd like to remove file(1) and libmagic(3) from the FreeBSD base system > >for the following reasons: > >1. I don't see it as being a necessary component of a UNIX-like operating > >system. > >2. It's available in the ports tree. > >3. Due to its nature as a program which parses multiple data formats, it > >poses an unusually high risk of having security problems in the future > >(cf. ethereal/wireshark). > > > >The one redeeming feature of file/libmagic as far as security is concerned > >is that it doesn't act as a daemon, i.e., other code or user intervention > >is required for an attacker to exploit security issues. This is why I'm > >asking here rather than wielding the "Security Officer can veto code which > >he doesn't like" stick. :-) > > > >Can anyone make a strong argument for keeping this code in the base system? > > Yes, because other OS's have it (file) in their base, and because > it is a POSIX-defined utility. Please consider this a strong no. I agree with Daniel. -- - Alfred Perlstein
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20070523195933.GM21795>