🚀 go-pugleaf

In article <1992Oct23.103957.5697@pilhuhn.ka.sub.org>  
hwr@pilhuhn.ka.sub.org (Heiko W.Rupp) writes:
  [cryft deleted]
  > Every user even with least permissions on your system is able to
  > change the settings of trusted ans so users via PrinterMangler - so he
  > can make himself the only unrestricted user and delete all faxes ;-(
  > I think creation of printers and so, should only be done by users with
  > uid=0. Normal users (even when in wheel group) should only be able to
  > delete their jobs submitted to the queue(s).
  > I'd say, this is a security leak.
  > 
  > Interesting enough, removing the suid and sgid bits on
  > /NextApps/PrinterManager.app/PrinterManager does not change anything
  > in this behaviour.
  > 
  > 
  > -- 
  > Heiko W.Rupp  Gerwigstr.5  7500 Kh'e 1  hwr@pilhuhn.ka.sub.org  +49  
721 693642

--

In NeXTadmin Documentation, see the entry for _writers under Implementing  
Security which controls who (by user) has the ability to write into  
(modify) netinfo directories such as fax_modems and printers. By default,  
the access is * which indicates unrestricted access.
Admittedly, this is not the most obvious of all 'features' of NetInfo (;<) 
-------------------------------------------------------
James L. Mynatt
NeXT Computer, Inc.
USPS:	Echelon IV, Suite 400
		9430 Research Blvd.
		Austin, Tx. 78759