From owner-freebsd-ports Mon Sep 20 13:21:40 1999 Delivered-To: freebsd-ports@freebsd.org Received: from saturn.psn.net (saturn.psn.net [207.211.58.15]) by hub.freebsd.org (Postfix) with ESMTP id 8E16B14BD2; Mon, 20 Sep 1999 13:21:36 -0700 (PDT) (envelope-from will@blackdawn.com) Received: from shadow.blackdawn.com (5042-243.008.popsite.net [209.224.140.243]) by saturn.psn.net (8.9.3/8.9.3) with ESMTP id NAA02947; Mon, 20 Sep 1999 13:28:46 -0700 (MST) Received: (from will@localhost) by shadow.blackdawn.com (8.9.3/8.9.3) id QAA09094; Mon, 20 Sep 1999 16:20:41 -0400 (EDT) (envelope-from will) Message-ID: X-Mailer: XFMail 1.3 [p0] on FreeBSD X-Priority: 3 (Normal) Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 8bit MIME-Version: 1.0 In-Reply-To: Date: Mon, 20 Sep 1999 16:20:40 -0400 (EDT) Reply-To: Will Andrews From: Will Andrews To: Kris Kennaway Subject: Re: ports/13809: new port: sysutils/wmbattery Cc: freebsd-ports@FreeBSD.ORG Sender: owner-freebsd-ports@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org On 20-Sep-99 Kris Kennaway wrote: > On Tue, 21 Sep 1999, TAOKA Satoshi wrote: >> I think wmbattery had better be set gid (to operator). >> See wmapm port. I agree.. I inadvertently forgot to add that part.. > Better make sure it's secure - many of these wm* utilities share a common > heritage, and at least one (wmmon) contained buffer overflows from > command-line arguments, and even processed arbitrary shell commands in a > dotfile as the setuid user. :-( Well.. not much I can do about it right now since I don't even know what programming habits/mistakes lead to buffer overflows.. meaning I can't look for buffer overflows in wmbattery. People install ports at their own risk. There are, after all, ways for a user to place restrictions on the programs installed by such. -- Will Andrews GCS/E/S @d- s+:+>+:- a--->+++ C++ UB++++ P+ L- E--- W+++ !N !o ?K w--- ?O M+ V-- PS+ PE++ Y+ PGP+>+++ t++ 5 X++ R+ tv+ b++>++++ DI+++ D+ G++>+++ e->++++ h! r-->+++ y? To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-ports" in the body of the message