🚀 go-pugleaf

RetroBBS NetNews Server

Inspired by RockSolid Light RIP Retro Guy

Article View: comp.lang.postscript
Article #1784

Re: WAISified PostScript would constitute a security hole

#1784
From: Alan J Rosenthal
Date: Sat, 15 Aug 1992 18:14
23 lines
1861 bytes
skyhawk@milton.u.washington.edu (Scott Northrop) writes:
>With a chroot(), you wouldn't be able to re-read files, or specify new files
>to preview without re-invoking the program.

The user-interface portion wouldn't have to do the chroot.  The interpreter
could be a separate executable, and the user-interface could fork the
interpreter and do a chroot in the child process (i.e. just before execing the
interpreter).  Then the user-interface portion can do what it wants with any
files once the interpreter exits.

>You'd also have to make hard links or copies into the new directory for the
>previewer to use.  A PostScript previewer would, I imagine, use a great many
>files.  You could make hard links to the real files if you put the directory
>on the same disk as all the needed files, if they're all on the same disk.
>Otherwise, you'll need a copy of everything the previewer would need to run,
>including copies of all your locally-installed fonts, etc.  And hope you've
>found all the necessary files!

No way!!  Don't make some new empty directory and chroot there, just
chroot to the directory containing all the files.  Something like
/usr/local/lib/ps-preview or whatever.  As for the user's postscript file,
supply that on standard input.  Or for that matter on any agreed-upon channel
number.
Technical Details
Message-ID: <1992Aug15.141417.28297@jarvis.csri.toronto.edu>
Path: arc1-ca.pugleaf.net!sparky!uunet!utcsri!dgp.toronto.edu!flaps
References: <1992Aug10.212402.8645@Synopsys.Com> <1992Aug11.181742.14199@adobe.com> <cx4mcgb.nagle@netcom.com> <58AI158@taronga.com> <616m1d_.nagle@netcom.com> <skyhawk.713832721@milton>

Show Full Headers
Complete Article Headers
Path: arc1-ca.pugleaf.net!sparky!uunet!utcsri!dgp.toronto.edu!flaps
Newsgroups: comp.lang.postscript,alt.security,comp.infosystems.wais
From: flaps@dgp.toronto.edu (Alan J Rosenthal)
Subject: Re: WAISified PostScript would constitute a security hole
Message-ID: <1992Aug15.141417.28297@jarvis.csri.toronto.edu>
References: <1992Aug10.212402.8645@Synopsys.Com> <1992Aug11.181742.14199@adobe.com> <cx4mcgb.nagle@netcom.com> <58AI158@taronga.com> <616m1d_.nagle@netcom.com> <skyhawk.713832721@milton>
Date: 15 Aug 92 18:14:17 GMT
Lines: 23