Re: Viruses

[BMBros <bmbros magicnet org>]

At 17:05 06/07/99 -0500, Alan Shutko wrote:
>* Package installations nearly always have to be done as root.

To compile gnome and everything with it, I created a user gnome that owns /opt/gnome and installed everything there. I suid'd root ldconfig and all the installation was done without any 'su' (except to fix some compilation problems).

People could create an 'installer user' that owns /usr/local and install everything there. Any script executed during installation could only delete or alter other installed programs. This is bad, but not as having write permission to all files or devices... And there are probably some solutions to fix that (removing write access to the installed files? chown them to an 'installed user'?). That way, none of the files in the package is executed as root.

I don't know much about rpm since I quite never used them, but the same thing can probably apply..


BMBros
bmbros@magicnet.org