From owner-freebsd-hackers@FreeBSD.ORG Sun Aug 14 07:49:54 2005 Return-Path: X-Original-To: hackers@freebsd.org Delivered-To: freebsd-hackers@FreeBSD.ORG Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id EF17B16A41F for ; Sun, 14 Aug 2005 07:49:54 +0000 (GMT) (envelope-from gjb@gbch.net) Received: from gw.gbch.net (gw.gbch.net [203.143.238.93]) by mx1.FreeBSD.org (Postfix) with SMTP id ED61343D46 for ; Sun, 14 Aug 2005 07:49:53 +0000 (GMT) (envelope-from gjb@gbch.net) Received: (qmail 48053 invoked from network); 14 Aug 2005 17:49:51 +1000 Received: from iliad.gbch.net (172.16.1.9) by gw.gbch.net with SMTP; 14 Aug 2005 17:49:51 +1000 Received: (qmail 36600 invoked by uid 1001); 14 Aug 2005 17:49:50 +1000 Message-ID: Date: Sun, 14 Aug 2005 17:49:50 +1000 From: Greg Black To: =?iso-8859-1?Q?Jo=C3=A3o_Carlos_Mendes_Lu=C3=ADs?= References: <42FD15EA.8050500@jonny.eng.br> <20050812233728.GA22225@odin.ac.hmc.edu> <42FE1781.9050403@jonny.eng.br> <42FEDE50.8050107@jonny.eng.br> Mime-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: <42FEDE50.8050107@jonny.eng.br> User-Agent: Mutt/1.4.2.1i; gjb-muttsend.sh 1.7 2004-10-05 X-Uptime: 58 days X-Operating-System: FreeBSD 5.4-RELEASE i386 X-Location: Brisbane, Australia; 27.49841S 152.98439E X-URL: http://www.gbch.net/gjb.html X-Blog: http://www.gbch.net/gjb/blog/ X-Image-URL: http://www.gbch.net/gjb/gjb-auug048.gif X-PGP-Key-Fingerprint: EBB2 2A92 A79D 1533 AC00 3C46 5D83 B6FB 4B04 B7D6 X-Request-PGP: http://www.gbch.net/keys/4B04B7D6.asc Cc: hackers@freebsd.org Subject: Re: File create permissions, what am I missing? X-BeenThere: freebsd-hackers@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Technical Discussions relating to FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 14 Aug 2005 07:49:55 -0000 On 2005-08-14, João Carlos Mendes Luís wrote: > Greg Black wrote: >> On 2005-08-13, Jo�o Carlos Mendes Lu�s wrote: >>> Brooks Davis wrote: >>> >>>> On BSD systems, the group of a file is always the group of the directory >>>> it is in. This differs from SysV UNIX. The resident grey-beard at work >>>> feels this is a new and annoying behavior. (i.e. it wasn't always this >>>> way. :) >>> >>> So this is expected behavior? Isn't this someway insecure? >> >> It is documented behaviour (see open(2) for details). How is it >> insecure? > > I don't know how it could be unsecure. So why suggest that it is? If you find something that is actually insecure, by all means bring it to people's attention; but don't just randomly speculate without any evidence. The mere fact that it's unfamiliar to you or somehow different from your normal expectations is not in itself sufficient reason to proclaim that there's a problem. > Is there any specifc reason for it to be > different on SYSV and Linux? Or is it just a different choice? It's a different (and IMO better) choice. And if you care about the reasons, by all means track down the different histories that led to the choices that were made. But that's not really a topic to flog to death here. > I could not find any vulnerability, but I do not like the idea that a user could > create files belonging to a group himself does not belong. He can only do this if he has write permission in the directory in question and of course he also has write permission to the file. The fact that it might belong to a group he is not a member of is irrelevant to security. As has been pointed out, there are some useful things that you can do with this feature and, as always with these things, it's important to understand how things work before setting out to use them. And, while I'm at it, I'd point out that these questions are better put on the questions list, as they are not really in the domain of this list. Greg