[Netatalk-devel] Re: Helping Out

[Marc M. <it...@ma...>]

I'd say RTFM, but briefly...

There is no problem with dropbox as long as you can avoid these scenarios:

* Dropping a folder into a dropbox
* Placing data in a dropbox that you wouldn't want any user with shell
access to be able to get to.  If they can guess the file name, they can
copy it right out.  I have a feeling it's because of the file being opened
RDWR when it only needs to be opened WR.  That way I could turn off
setting the world-read bit and the file would still write correctly.  But
I haven't had a chance to try that out.

On Tue, 27 Feb 2001, jeff wrote:

> "Marc J. Miller" wrote:
> > >What's Dropkludge? I assume it is some kludge to mimic the
> > >AppleShare Server "drop box" world write/owner rwx thingee.
> > 
> > That's how it started... I eventually discovered that the same permission
> > handling that was preventing Dropboxes from working was also creating other
> > bugs.  So I made the changes universal.  It not only maintains rwx
> > permissions, but it also makes sure that every file created within a
> > directory has the same owner and group as the directory itself.  That's
> > what Mac expects.  Unfortunately, I've run into a couple of difficulties --
> > a known security hole which is extremely well-documented on Sourceforge
> > (check the DocManager) and a difficulty that when someone drops a folder
> > into a dropbox, the dropped folder also becomes a dropbox, owned by whoever
> > dropped it there.  That's related to the setgid being set on the dropbox
> > and permission inheritance.
> 
> Sorry about the lateness of this email.
> 
> Are you saying that there are security problems inherant in matching
> file permissions to directory permissions, or that there specifically a
> problem with matching file permissions to directory permissions where
> they are world accessable ... ?
> 
> I only ask because I was looking at making dropkludge available by
> share, which may be a good idea, but also may still pose a security
> concern. What's your opinion on that?
> 
> --SNIP--
> 
> > We have a TODO list in the CVS.  That seems like a good starting point...
> > perhaps someone (Jeff?!) could update the bug tracker with some of the info
> > there and decide what bugs are critical, what bugs could wait for now, etc.
> 
> I've been running through the bugs list, patching the ones I can, and
> marking down the ones for 1.4b2 and other older versions.
> 
> If anyone else would like to help me run through the bugs list, it would
> be much appreciated.
> 
> jeff
> 
> (as usual, with tremendous apologies for the cross-posting)
> 

============================================================
	/\/\arc ._|. /\/\iller (it...@ma...)
	Computer Room Consultant
	Information Technology/Lab Management
============================================================
I can be contacted through the Communication Center link from
http://www.mother.com/~mjmiller/