[Bug 1158538] patch2mail: security hardening: run as unprivileged user
http://bugzilla.opensuse.org/show_bug.cgi?id=1158538 http://bugzilla.opensuse.org/show_bug.cgi?id=1158538#c1 Christian Boltz <suse-beta@cboltz.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Flags| |needinfo?(matthias.gerstner | |@suse.com) --- Comment #1 from Christian Boltz <suse-beta@cboltz.de> --- Correct me if I'm wrong, but - AFAIK at least refreshing the repos needs to be done as root, right? In the end, the script would look like that (pseudocode): if running_as_root { zypper -q refresh reexec_as_nobody $0 } else { current_content_of_the_script # except changing # zypper lu -> zypper --no-refresh lu) } Does that look correct and good? One problem / possible regression I see is that errors in "zypper -q refresh" will not end up in the zypper lu output, and therefore won't be visible anymore. Any ideas how to avoid this problem? (Ideally only zypper lu would run as root, but I'm afraid implementing this without using sudo is very hard.) (One option might be not to add --no-refresh to zypper lu so that it fails again.) Any ideas or opinions on this "detail"? ;-) -- You are receiving this mail because: You are on the CC list for the bug.
participants (1)
-
bugzilla_noreply@novell.com