🚀 go-pugleaf

In article <62524@cup.portal.com> VESOFT@cup.portal.com (Michael D Hensley) writes:
>Agree/disagree/discussion: Any root-owned world-writable file should be
>considered a potential security loophole.
>What do you think?

Only if the system trusts the contents of the file, or root executes it,
or the uid or gid bit is set (on those weird variations of UNIX that don't
clear the bits when the file is modified).  Otherwise, what could you
possibly do that would create a security problem, just because the file is
owned by root and not, say, nobody?

(I am aware that the file could be used to get around quotas, if applicable,
but I don't really consider that a security loophole.  The worst a user could
do is fill up the file system, but that results in no permanent damage.
Just one less user.  :-))

-- 
John C. Fowler, jfowler@lanl.gov