From owner-freebsd-ports  Thu Oct 18  6: 3:53 2001
Delivered-To: freebsd-ports@freebsd.org
Received: from nagual.pp.ru (pobrecita.freebsd.ru [194.87.13.42])
	by hub.freebsd.org (Postfix) with ESMTP id E748C37B409
	for <ports@FreeBSD.org>; Thu, 18 Oct 2001 06:03:47 -0700 (PDT)
Received: (from ache@localhost)
	by nagual.pp.ru (8.11.6/8.11.6) id f9ID3gS64779;
	Thu, 18 Oct 2001 17:03:42 +0400 (MSD)
	(envelope-from ache)
Date: Thu, 18 Oct 2001 17:03:42 +0400
From: "Andrey A. Chernov" <ache@nagual.pp.ru>
To: Sheldon Hearn <sheldonh@starjuice.net>
Cc: Yarema <yds@dppl.com>, ports@FreeBSD.org
Subject: Re: HEADS UP: Apache port change from nobody:nogroup to www:www planned
Message-ID: <20011018170342.B64487@nagual.pp.ru>
References: <20011018161609.A63967@nagual.pp.ru> <29090.1003407835@axl.seasidesoftware.co.za>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <29090.1003407835@axl.seasidesoftware.co.za>
User-Agent: Mutt/1.3.23i
Sender: owner-freebsd-ports@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-ports.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-ports>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-ports>
X-Loop: FreeBSD.org

On Thu, Oct 18, 2001 at 14:23:55 +0200, Sheldon Hearn wrote:

> > Any priviledges, read/write/etc. Nobody is internal NFS user means 'root'.
> 
> To NFS, nobody _may_ mean "the user to which root should be mapped".  The
> system should _never_ be structured such that having nobody privelege is
> equivalent to having root privelege.

Yes, I just not reproduce full phrase, I mean 'root in some sense'

> Specifically, one usually maps a foreign host's root to the local
> nobody.  This means "foreign host's root has world-only permissions".

And it not means that Apache allowed to read nobody files with 700 
permissions.

> This is sounding worse and worse to me.  Could you maybe provide an
> example that demonstrates the danger you're trying to protect against?

See one above. And not forget about NIS, which use nobody in special way 
too.

-- 
Andrey A. Chernov
http://ache.pp.ru/

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-ports" in the body of the message