From owner-freebsd-security Wed Mar 8 0:52:50 2000 Delivered-To: freebsd-security@freebsd.org Received: from m3.cs.berkeley.edu (m3.CS.Berkeley.EDU [128.32.45.179]) by hub.freebsd.org (Postfix) with ESMTP id 1746B37B5A5; Wed, 8 Mar 2000 00:52:45 -0800 (PST) (envelope-from asami@stampede.cs.berkeley.edu) Received: from silvia.hip.berkeley.edu (sji-ca1-183.ix.netcom.com [209.109.232.183]) by m3.cs.berkeley.edu (8.9.3/8.9.3) with ESMTP id AAA72252; Wed, 8 Mar 2000 00:52:35 -0800 (PST) (envelope-from asami@stampede.cs.berkeley.edu) Received: (from asami@localhost) by silvia.hip.berkeley.edu (8.9.3/8.6.9) id AAA53685; Wed, 8 Mar 2000 00:52:10 -0800 (PST) To: Kris Kennaway Cc: security@freebsd.org, ports@freebsd.org Subject: Re: cvs commit: ports/games/omega Makefile (fwd) References: From: asami@freebsd.org (Satoshi - Ports Wraith - Asami) Date: 08 Mar 2000 00:52:03 -0800 In-Reply-To: Kris Kennaway's message of "Wed, 8 Mar 2000 00:42:26 -0800 (PST)" Message-ID: Lines: 28 X-Mailer: Gnus v5.7/Emacs 20.5 Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org * From: Kris Kennaway * I'm not going to generate a security advisory about this, but reinstall * this port if you have it. Thanks, for catching it. * In general, if you have anything installed which is setuid games on a * multiuser machine, it's a good candidate for removal (games aren't the * most securely-programmed things): * * find /usr/local/bin -user games -perm -4000 * * Ports maintainers who own such a file (please check the above!) please * make the necessary changes to install it setgid games, not setuid foo. * * A user who exploits a game binary to get the games group probably can't do * much apart from alter game score/save files (although this still might be * a security risk if you can convince the game to somehow execute code you * put in the file), whereas if they have setuid games they can trojan the * binary directly for the next user. This should not be allowed to happen. Shouldn't all binaries be installed without write permission? That's the way it is in /usr, maybe we should mandate it in /usr/local and /usr/X11R6. (Hmm, why does imake config files want to install stuff with permission *755?) Satoshi To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message