From owner-cvs-all@FreeBSD.ORG  Thu Nov 16 22:25:22 2006
Return-Path: <owner-cvs-all@FreeBSD.ORG>
X-Original-To: cvs-all@FreeBSD.org
Delivered-To: cvs-all@FreeBSD.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 4F7D416A415;
	Thu, 16 Nov 2006 22:25:22 +0000 (UTC)
	(envelope-from kris@obsecurity.org)
Received: from elvis.mu.org (elvis.mu.org [192.203.228.196])
	by mx1.FreeBSD.org (Postfix) with ESMTP id A55AD43D5F;
	Thu, 16 Nov 2006 22:25:21 +0000 (GMT)
	(envelope-from kris@obsecurity.org)
Received: from obsecurity.dyndns.org (elvis.mu.org [192.203.228.196])
	by elvis.mu.org (Postfix) with ESMTP id 8E97A1A3C1E;
	Thu, 16 Nov 2006 14:25:21 -0800 (PST)
Received: by obsecurity.dyndns.org (Postfix, from userid 1000)
	id 8B8F05159E; Thu, 16 Nov 2006 17:25:09 -0500 (EST)
Date: Thu, 16 Nov 2006 17:25:09 -0500
From: Kris Kennaway <kris@obsecurity.org>
To: Jean-Yves Lefort <jylefort@FreeBSD.org>
Message-ID: <20061116222509.GA70087@xor.obsecurity.org>
References: <200611161949.kAGJnDr5074353@repoman.freebsd.org>
	<20061116211550.GA68969@xor.obsecurity.org>
	<20061116225709.13d06775.jylefort@FreeBSD.org>
Mime-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha1;
	protocol="application/pgp-signature"; boundary="ibTvN161/egqYuK8"
Content-Disposition: inline
In-Reply-To: <20061116225709.13d06775.jylefort@FreeBSD.org>
User-Agent: Mutt/1.4.2.2i
Cc: security-team@FreeBSD.org, cvs-ports@FreeBSD.org,
	ports-committers@FreeBSD.org, cvs-all@FreeBSD.org,
	Kris Kennaway <kris@obsecurity.org>
Subject: Re: cvs commit: ports/sysutils/hal Makefile
	ports/sysutils/hal/files patch-hal.conf.in
X-BeenThere: cvs-all@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: CVS commit messages for the entire tree <cvs-all.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/cvs-all>,
	<mailto:cvs-all-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/cvs-all>
List-Post: <mailto:cvs-all@freebsd.org>
List-Help: <mailto:cvs-all-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/cvs-all>,
	<mailto:cvs-all-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Thu, 16 Nov 2006 22:25:22 -0000


--ibTvN161/egqYuK8
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Thu, Nov 16, 2006 at 10:57:09PM +0100, Jean-Yves Lefort wrote:
> On Thu, 16 Nov 2006 16:15:50 -0500
> Kris Kennaway <kris@obsecurity.org> wrote:
>=20
> > On Thu, Nov 16, 2006 at 07:49:13PM +0000, Jean-Yves Lefort wrote:
> > > jylefort    2006-11-16 19:49:13 UTC
> > >
> > >   FreeBSD ports repository
> > >
> > >   Modified files:
> > >     sysutils/hal         Makefile
> > >   Added files:
> > >     sysutils/hal/files   patch-hal.conf.in
> > >   Log:
> > >   Give wheel group members the same rights as operator group members.
> >
> > This violates the definition of the wheel group, FYI (even though it
> > might seem expedient), so it can be viewed as a weakening of the
> > security model.  Prior to this commit, the only right that the wheel
> > group had was the ability to attempt to su to root, if the user knows
> > the password.
>=20
> The commit message should have been:
>=20
> Give wheel group members the same HAL rights (mount a volume, etc) as
> operator group members.

Yes, I understood.  My point was that this was precisely the role of
the operator group, so you've combined two entities which previously
had distinct security behaviours.

Kris

--ibTvN161/egqYuK8
Content-Type: application/pgp-signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (FreeBSD)

iD8DBQFFXOVFWry0BWjoQKURAoTzAKDfEf2Ij2Vhl4EjawP5mKHQFVWKBACgqN80
1yzKd8s6j9Vcy4eLuUxJytw=
=I0PZ
-----END PGP SIGNATURE-----

--ibTvN161/egqYuK8--