Re: Removing DAC.

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Monday 24 March 2008 23:12, Joshua Brindle <method@xxxxxxxxxxxxxxx> wrote:
> we certainly have alot more types today, I'm not sure if that was the
> real obstacle though.

The real obstacle is bad design.

I don't think that there has ever been a time when it made sense to use the 
same file name for either a program or a plain text config file.

It might make some sense to try to execute /etc/daemon-config.sh and then 
read /etc/daemon-config if that fails (or the other way around).  Having a 
one-line config file which says "execute program X" would also make sense.

Using the same file name for both such that a horrible disaster is only a 
single chmod command away is just a bad idea.  I recall reading in a version 
of the Unix Horror stories about how someone accidentally made some C source 
code executable, and somehow when the C source in question was executed as a 
shell script it gave the same result as "rm -rf /".

-- 
russell@xxxxxxxxxxxx
http://etbe.coker.com.au/          My Blog

http://www.coker.com.au/sponsorship.html Sponsoring Free Software development

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@xxxxxxxxxxxxx with
the words "unsubscribe selinux" without quotes as the message.

[Index of Archives]     [Selinux Refpolicy]     [Linux SGX]     [Fedora Users]     [Fedora Desktop]     [Yosemite Photos]     [Yosemite Camping]     [Yosemite Campsites]     [KDE Users]     [Gnome Users]

  Powered by Linux