Date: Fri, 16 Feb 2001 10:08:34 +0200 From: Ruslan Ermilov <ru@FreeBSD.org> To: Robert Watson <rwatson@FreeBSD.org> Cc: arch@FreeBSD.org Subject: Re: [Call for *quick* review] architecture-specific manpages Message-ID: <20010216100833.G2869@sunbay.com> In-Reply-To: <Pine.NEB.3.96L.1010215161901.45974A-100000@fledge.watson.org>; from rwatson@FreeBSD.org on Thu, Feb 15, 2001 at 04:23:15PM -0500 References: <20010215211404.A44780@sunbay.com> <Pine.NEB.3.96L.1010215161901.45974A-100000@fledge.watson.org>
next in thread | previous in thread | raw e-mail | index | archive | help
On Thu, Feb 15, 2001 at 04:23:15PM -0500, Robert Watson wrote: > On Thu, 15 Feb 2001, Ruslan Ermilov wrote: > > > The attached patch implements one nice feature of original BSD man(1), > > to look into the machine-specific subdirectory, specifically: > > > > : As some manual pages are intended only for specific architectures, > > : man searches any subdirectories, with the same name as the current > > : architecture, in every directory which it searches. Machine specific > > : areas are checked before general areas. The current machine type may > > : be overridden by setting the environment variable MACHINE to the name > > : of a specific architecture. > > > > This would eliminate the need to MLINK every arch-specific file to the > > parent directory, and would allow us to have both architecture-specific > > and generic manpages with the same name in the same section. > > It's a good idea to check the results of calls like snprintf or you can > get truncation bugs. I'd recommend you go pass these patches by -audit. > Any time you have programs running with privilege of some sort (and yes, > setuid man or setgid man counts as privilege), you have to be *really* > careful. These patches do not appear to be very careful at all, and they > seem to make heavy use of environmental variables in constructing strings. > Oh common, you can supply whatever you want in $MANPATH, and have man(1) look into whatever path you tell it to. The setgidness of man(1) is only to allow creation of catpages, and does not hurt everything else. Two days ago I fixed the bug in manpath that would allow a malicious user create empty catpages, and sent the notice to security-officer (which you are a member of). I got no replies so far, and I am a bit confused since (in my opinion) this definitely deserves the security advisory. > I'd personally feel a lot more comfortable with all this if we'd simply > remove the setuid/setgid man'ness of man, and either pre-generate cached > pages as appropriate, or simply eschew caching, given the speed of modern > machines. > Not everyone has the ability to buy the "modern" machine, so disabling catpages building would not work. Just delete cat* subdirectories, and man(1) will intelligently skip creating catpages for you. -- Ruslan Ermilov Oracle Developer/DBA, ru@sunbay.com Sunbay Software AG, ru@FreeBSD.org FreeBSD committer, +380.652.512.251 Simferopol, Ukraine http://www.FreeBSD.org The Power To Serve http://www.oracle.com Enabling The Information Age To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-arch" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20010216100833.G2869>