From owner-freebsd-security Tue Nov 5 11:21:20 2002 Delivered-To: freebsd-security@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 9BFA437B401 for ; Tue, 5 Nov 2002 11:21:18 -0800 (PST) Received: from cithaeron.argolis.org (pool-138-88-125-24.res.east.verizon.net [138.88.125.24]) by mx1.FreeBSD.org (Postfix) with ESMTP id 7237A43E7B for ; Tue, 5 Nov 2002 11:21:12 -0800 (PST) (envelope-from piechota@argolis.org) Received: from cithaeron.argolis.org (localhost [127.0.0.1]) by cithaeron.argolis.org (8.12.6/8.12.5) with ESMTP id gA5JKshU028215; Tue, 5 Nov 2002 14:20:54 -0500 (EST) (envelope-from piechota@argolis.org) Received: from localhost (piechota@localhost) by cithaeron.argolis.org (8.12.6/8.12.6/Submit) with ESMTP id gA5JKrmN028212; Tue, 5 Nov 2002 14:20:53 -0500 (EST) X-Authentication-Warning: cithaeron.argolis.org: piechota owned process doing -bs Date: Tue, 5 Nov 2002 14:20:53 -0500 (EST) From: Matt Piechota To: Eric Anderson Cc: Klaus Steden , Subject: Re: per-user groups In-Reply-To: <3DC80F76.4020909@centtech.com> Message-ID: <20021105141841.F27225-100000@cithaeron.argolis.org> MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.org On Tue, 5 Nov 2002, Eric Anderson wrote: > My understanding (which is most probably incorrect), is that it is safer > to assign a new group per user, then automatically default them to some > set group. > > In other words - people are lazy, and so if that's true (it is), then > they are likely to believe that the default is the best choice. If all > users default to some standard group, then it is far easier to have > accidentally set a file to mode 775 (or some such variant), and have the > whole user base have rights to it, than a default group of the user > itself - which would be limited. It also makes sharing safer without admin intervention: bob@foo% chgrp fred myfile ; chown 750 myfile bob@foo% echo 'check out myfile' | write fred -- Matt Piechota To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message