Date: Thu, 16 Nov 2006 17:25:09 -0500 From: Kris Kennaway <kris@obsecurity.org> To: Jean-Yves Lefort <jylefort@FreeBSD.org> Cc: security-team@FreeBSD.org, cvs-ports@FreeBSD.org, ports-committers@FreeBSD.org, cvs-all@FreeBSD.org, Kris Kennaway <kris@obsecurity.org> Subject: Re: cvs commit: ports/sysutils/hal Makefile ports/sysutils/hal/files patch-hal.conf.in Message-ID: <20061116222509.GA70087@xor.obsecurity.org> In-Reply-To: <20061116225709.13d06775.jylefort@FreeBSD.org> References: <200611161949.kAGJnDr5074353@repoman.freebsd.org> <20061116211550.GA68969@xor.obsecurity.org> <20061116225709.13d06775.jylefort@FreeBSD.org>
next in thread | previous in thread | raw e-mail | index | archive | help
--ibTvN161/egqYuK8 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Thu, Nov 16, 2006 at 10:57:09PM +0100, Jean-Yves Lefort wrote: > On Thu, 16 Nov 2006 16:15:50 -0500 > Kris Kennaway <kris@obsecurity.org> wrote: >=20 > > On Thu, Nov 16, 2006 at 07:49:13PM +0000, Jean-Yves Lefort wrote: > > > jylefort 2006-11-16 19:49:13 UTC > > > > > > FreeBSD ports repository > > > > > > Modified files: > > > sysutils/hal Makefile > > > Added files: > > > sysutils/hal/files patch-hal.conf.in > > > Log: > > > Give wheel group members the same rights as operator group members. > > > > This violates the definition of the wheel group, FYI (even though it > > might seem expedient), so it can be viewed as a weakening of the > > security model. Prior to this commit, the only right that the wheel > > group had was the ability to attempt to su to root, if the user knows > > the password. >=20 > The commit message should have been: >=20 > Give wheel group members the same HAL rights (mount a volume, etc) as > operator group members. Yes, I understood. My point was that this was precisely the role of the operator group, so you've combined two entities which previously had distinct security behaviours. Kris --ibTvN161/egqYuK8 Content-Type: application/pgp-signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (FreeBSD) iD8DBQFFXOVFWry0BWjoQKURAoTzAKDfEf2Ij2Vhl4EjawP5mKHQFVWKBACgqN80 1yzKd8s6j9Vcy4eLuUxJytw= =I0PZ -----END PGP SIGNATURE----- --ibTvN161/egqYuK8--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20061116222509.GA70087>