On Tue, Oct 02, 2001 at 04:39:27AM -0500, D J Hawkey Jr wrote:
> On Oct 02, at 09:33 AM, Christian Kratzer wrote:
> >
> > Hi,
> >
> > On Tue, 2 Oct 2001, D J Hawkey Jr wrote:
> >
> > > In article <Pine.LNX.4.33.0110020953290.6866-100000_localhost.cksoft.dens.sol.net>,
> > > ckcksoft.de writes:
> > > >
> > > > If you are talking about cgi scripts run by apache you might want to
> > > > patch suexec to do this. There is nothgin in apache that would normally
> > > > set the requested privilidges.
> > > >
> > > > we added following to apache-x-x-x/src/support/suexec.c to actually
> > > > enforce setting of resource limits. There is nothing in apache that would
> > > > normally set these up for you.
> > > >
> > > > [SNIP]
> > >
> > > Reading between the lines, are you saying that any app "not from FreeBSD"
> > > running on FreeBSD isn't likely to be accounted for because they pro'lly
> > > don't set up limiting resources (by way of the C function you hacked in)?
> > >
> > > Badly phrased, I know, but you get my drift?
> >
> > it's not as bad as you may think.
> >
> > Any user logging in through the "usual" channels like sshd,telnetd,console,etc...
> > should get the limits automatically setup for them.
>
> Running X apps remotely falls into the above group, I assume?
>
> > We only need to patch applications like apache which start child processes
> > and use seteuid() to change their effective uid etc... and are not aware of
> > the freebsd specific possibilities.
>
> This make sense [to me], but Peter seems to disagree. Can either of you
> address the other's position?

I think Christian's right, and I'm sorry for the confusion which
my hasty reply brought :) Of course the context needs only be set
once, when changing uid's.

G'luck,
Peter

-- 
What would this sentence be like if it weren't self-referential?
To Unsubscribe: send mail to majordomoFreeBSD.org
with "unsubscribe freebsd-security" in the body of the message

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]