Re: Session IDs & LUID point to consider.

From: Horst von Brand (vonbrand@sleipnir.valparaiso.cl)
Date: Fri Apr 21 2000 - 15:06:46 EST

Linda Walsh <law@sgi.com> said:

[...]

> Another problem is 'cron'. While 'at' can encode an luid in the job name how
> do you tell what authorized user is running a 'cronjob'? One authorized
> user could be executing an SUID program to another user and edit that user's
> crontab. The only way I can come up with there is to dis-allow user-level
> cronjobs on a secure system (using existing configuration options:
> cron.allow/deny).

You could record the LUID which last changed the crontab file offline, and
make crond(8) run it under that one. 

-- 
Horst von Brand                             vonbrand@sleipnir.valparaiso.cl
Casilla 9G, Viņa del Mar, Chile                               +56 32 672616

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/

This archive was generated by hypermail 2b29 : Sun Apr 23 2000 - 21:00:19 EST