OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Subject: Re: Cobalt RaQ 3 security hole?
From: Brian Behlendorf (brianCOLLAB.NET)
Date: Fri Jul 21 2000 - 19:05:16 CDT

On Thu, 20 Jul 2000, Joshua Ellis wrote:
> That's the standard RaQ install. If you do a /usr/sbin/http -V you'll see
> "-D BIG_SECURITY_HOLE". It's how their mod_perl-based admin modules work.
> If you look in /usr/lib/perl5/site_perl/5.005/Cobalt you'll see they modify
> a lot of files writable only by root, and HUP a lot of processes owned by
> root... Apache has to be running as root for you to do that.

Not really true; one can write a setuid C program that sends a signal to
restart the Apache process, and is small enough to be (close to) provably
secure. Small setuid binaries for other needs for root would be the way
to go. One has to be careful to design it so that it can't be used for
other unsafe purposes, but that's far more containable than running Apache
as root.

        Brian