From owner-freebsd-current@FreeBSD.ORG Sun Jun 25 08:08:25 2006 Return-Path: X-Original-To: freebsd-current@freebsd.org Delivered-To: freebsd-current@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id D8FEC16A54E for ; Sun, 25 Jun 2006 08:08:25 +0000 (UTC) (envelope-from imp@bsdimp.com) Received: from harmony.bsdimp.com (vc4-2-0-87.dsl.netrack.net [199.45.160.85]) by mx1.FreeBSD.org (Postfix) with ESMTP id 0DEA843D69 for ; Sun, 25 Jun 2006 08:08:23 +0000 (GMT) (envelope-from imp@bsdimp.com) Received: from localhost (localhost.village.org [IPv6:::1] (may be forged)) by harmony.bsdimp.com (8.13.4/8.13.4) with ESMTP id k5P86EsS072191; Sun, 25 Jun 2006 02:06:14 -0600 (MDT) (envelope-from imp@bsdimp.com) Date: Sun, 25 Jun 2006 02:06:16 -0600 (MDT) Message-Id: <20060625.020616.2040338822.imp@bsdimp.com> To: jrh29@eecs.cwru.edu From: "M. Warner Losh" In-Reply-To: References: X-Mailer: Mew version 4.2 on Emacs 21.3 / Mule 5.0 (SAKAKI) Mime-Version: 1.0 Content-Type: Text/Plain; charset=us-ascii Content-Transfer-Encoding: 7bit Cc: freebsd-current@freebsd.org Subject: Re: ~/.hosts patch X-BeenThere: freebsd-current@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussions about the use of FreeBSD-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 25 Jun 2006 08:08:25 -0000 In message: Justin Hibbits writes: : Hey folks, got an interesting patch. This adds a ~/.hosts file : (personal version of /etc/hosts). It was written against 6-STABLE : about a week before 6.1 was released, and has been sitting collecting : dust for the last month and a half. Currently it augments /etc/hosts : instead of replacing it or prepending it. Any comments? One : suggestion that was made was to make it an nss module so that it : could be controlled by the admin. It probably could use some cleanup : as well, just putting it out here for proof of concept for now, and : some direction. I specifically disabled similar functionality for setuid programs when I was security officer. It was for HOSTALIAS files. These are files that are read through the HOSTALIAS environment variable. this was implemented in resolv/res_query.c. similar to what you've listed here. Your check for setuid is insuffient. You should use issetugid() rather than the tests against euid and uid which can fail and doesn't take groups into account at all. http://www.freebsd.org/cgi/query-pr.cgi?pr=bin/3524 contains all the details, such as it is. Warner