Choosing A Webhost:
A web hosting service is a type of Internet hosting service that allows individuals and organizations to provide their own website accessible via the World Wide Web. Web hosts are companies that provide space on a server they own for use by their clients as well as providing Internet connectivity, typically in a data center. Web hosts can also provide data center space and connectivity to the Internet for servers they do not own to be located in their data center, called colocation. more...
|
Re: suid policy: msg#00001
lars wrote:
Hi,
I want to package a perl web-interface that needs root permissions for some
operations. As the perl-suid package is marked as deprecated, I am not sure,
how to do this in the good debian way ...
Maybe you could give me some hints.
As I recall, the whole idea of perl-suid was abandoned upstream. It
was found that it's not possible to do it securely.
The perl-cgi should be able to execute the following actions:
- use cryptsetup for partitions
- mount/umount _arbitrary_ mapped devices
- partition harddisks
For now I see the following options:
- write a short binary wrapper with suid permissions
- move all routines, that need root permission to a seperate script and add an
entry to /etc/sudoers for it
It does not seem to be sufficient, to just set the right permissions on selected
block devices, as only root may mount something without an entry to fstab.
Do you have any suggestions?
You could also add entries to sudoers for all the commands the
script needs to run. Then in your CGI script, instead of just
running the external program directly (mount, cfdisk, whatever),
you'd call sudo to run it. I think this would probably be the most
secure method. If you were to make another script and run *it*
through sudo, then you have to be *darn sure* that script is solid.
But by running each command through sudo, you can define exactly
what options and what devices are allowed--if you can narrow it down.
Allowing a web script to partition your hard disks sounds pretty
scary... But these days it seems there's a web script for
everything! :-)
ttyl
--
C. Chad Wallace, B.Sc.
The Lodging Company
http://skihills.com/
OpenPGP Public Key ID: 0x262208A0
|
| |
