http://bugzilla.novell.com/show_bug.cgi?id=542051 Stefan Dirsch changed: What |Removed |Added ---------------------------------------------------------------------------- Priority|P5 - None |P4 - Low Status|NEW |ASSIGNED CC| |sndirsch@novell.com Summary|xfs font server is poorly |xfs: some minor issues |installed; standard | |security risk of using | |nobody | -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=542051 User suse@tlinx.org added comment http://bugzilla.novell.com/show_bug.cgi?id=542051#c1 --- Comment #1 from L. A. Walsh 2009-10-02 09:37:29 MDT --- Created an attachment (id=320840) --> (http://bugzilla.novell.com/attachment.cgi?id=320840) sample xfs startup script Attaching sample changes to /etc/init.d/xfs startup script -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=542051 User suse@tlinx.org added comment http://bugzilla.novell.com/show_bug.cgi?id=542051#c3 --- Comment #3 from L. A. Walsh 2009-10-02 10:44:46 MDT --- the rc and conf scripts require 1) user.group == nscd.nscd be created by install 2) NOTE install script must not use -u optionn to startproc, or nscd will exit with failure (won't be able to switch itself to 'nscd and it's associated groups) 3) default perms on /var/run/nscd/socket, need to be set to /var/run/nscd/ nscd:nscd 755 /var/run/nscd/socket nscd:nscd 666 It's currently set to be owned by root. /etc/permissions{X} changes: (Using bits rwx=421 (in case my memory is faulty, documenting my assumption): for ugo:) 3) /etc/permissions should have: (allow all read/write access - normal) /var/run/nscd set to nscd:nscd 3755 /var/run/nscd/socket to nscd:nscd 666 4) /etc/permissions.secure to /var/run/nscd/ set to nscd:nscd 3751 /var/run/ncsd/socket to nscd:nscd 666 (Requires users be in group nscd to read dir contents but others would still be able to use nscd). 5) /etc/permissions.paranoid to: /var/run/nscd/ set to nscd:nscd 3710 /var/run/ncsd/socket to nscd:nscd 660 6) http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=542051 Stefan Dirsch changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #320841|application/octet-stream |text/plain mime type| | -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=542051 User suse@tlinx.org added comment http://bugzilla.novell.com/show_bug.cgi?id=542051#c5 --- Comment #5 from L. A. Walsh 2009-10-02 11:19:56 MDT --- re texlive permission settings: noted specifically/separately for textlive in bug 543849. (as it was a separate package, thought it should be recorded separately even though it is mentioned in this bug). -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=542051 User suse@tlinx.org added comment http://bugzilla.novell.com/show_bug.cgi?id=542051#c7 --- Comment #7 from L. A. Walsh 2009-10-05 10:07:06 PDT --- Honestly, I am not, now, sure entirely why I added the nscd comments to this(xfs) bug ... I might have been trying to add them to a separate bug and something was screwy with my browser cache and I didn't look carefully to ensure the attachment was being attached to the bug I meant it to be. I thought I added a bug about nscd...as the bug you mention (I assume you mean 540966, which mentioned 'unscd', which is close to what we are talking about?; I don't have access to 520966?). I hadn't seen 540966 until this morning... and I can't find the bug I thought I was adding this attachment to -- so only think I can think of was that I was entering a bug for nscd, after I added the attachment for xfs, and at some point hit "backspace" when focus wasn't in a text window and didn't notice the entire bug went back to the xfs bug and 'disappearred' my entry for nscd.... been running on a bit too little sleep at times (it was ~3am, my time when I was entering these ... ;^/ As for adding the comments to bug 540966(is that what you meant?) is 'unscd' the same as nscd? -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=542051 User suse@tlinx.org added comment http://bugzilla.novell.com/show_bug.cgi?id=542051#c9 L. A. Walsh changed: What |Removed |Added ---------------------------------------------------------------------------- Keywords| |security_vulnerability, | |Systemic Priority|P4 - Low |P3 - Medium Severity|Minor |Normal --- Comment #9 from L. A. Walsh 2009-10-09 13:17:29 PDT --- Comments added to bug 540966, title changed to reflect product name. Extra notes added. added tags as security_vulnerability (minor), but unsanitary security practice to have multiple daemons all co-mingling in the 'nobody.nobody' pool Raising this bug's prio P3/Normal (from P4/Minor), since the 'nobody/nobody' issue seems to be systemic.... SuSE should be way past that security detail, IMO, but maybe the security folk I've hung with have overemphasized its importance more than others might consider it....dunno. The group I hung with was also concerned about 'covert' information leakage channels...so that's why this issue is important -- not _usually_ (AFAIK), from a system-corruption problem -- just a system-insecurity. -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=542051 User suse@tlinx.org added comment http://bugzilla.novell.com/show_bug.cgi?id=542051#c11 L. A. Walsh changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |suse@tlinx.org --- Comment #11 from L. A. Walsh 2009-10-09 15:28:00 PDT --- Would you please get off your high horse and stop making such a fuss about this? I thought I was doing the right thing and you have a cow. Give me a break. _I_ use the xfs fonts server quite a bit -- I keep my main stash of fonts on a server, and use them on my Windows client. I now have the disk space to also have them on my Windows client, BUT, the local X-server doesn't recognize all of them and/or Doesn't render them as well using the 'native' rendering agent, as the 'glyph' rendering agent does over the network. This is an **ACCESSIBILITY** issue for me -- as the fonts rendered by the local X-font server, for 'some' reason, do not have the option to have font-smoothing turned on. But for *some* reason, the ones' coming from xft DO -- I have a direct switch 1GB connection, so speed isn't an issue. Maybe if xfs wasn't, by default configured 'off', and people saw the difference, there'd be more use of it. I don't know -- there may be settings or tweaks I could do to make things look better, but I'm dealing with a cross-platform (cygwin client) situation where I'm using a poorly documented X-server that technically open-source, but not in a useful sense like SuSE's (they use a proprietary build system that I've never been able to get to work). But I have nearly 1GB of fonts and it's alot more efficient to store the fonts in one place and use 'xfs' than duplicate the store on each of my client systems -- some of which are ancient, but function fine as backup DNS/BDC's, running on a 20G system. And here I was just thinking about how xfs needed some updating to to have better security (like paying attention to the hosts.deny/permit files...etc). submit requests in your buildserver for the affected packages? What are you talking about? Im reporting bugs.... What's a submit requests? It's hard enough with my RSI problems to submit a bug in one place ... at least here I can keep track of all of the bugs and query them with one request. What is a submit request? I have not delved into the details of the opensuse build process or community...I'm just reporting QA items. I'm sorry if that is upsetting you -- please don't take it personally. I don't know anything about it -- so its not about you. I don't understand why you seem to have such a hostile tone over this. I don't believe I've said or entered anything that was particularly provocative -- at least not by conscious intention, so please, don't take out your upsets on me, and please don't treat xfs running as 'nobody.nobody' as a minor issue -- I changed it to the same level as the nscd as it's the same type of bug. It may have less priority, but the level of the bug is the same or GREATER, since this bug had more problems reported with it than the one with ncsd (which only had the bad-user/group problem). So can you explain why this is a "minor" bug while the other is normal? (Priority, I can leave that decision to you, as you seem to regard xfs as unimportant, and that's a value judgement, but the severity of the bug? Why is it 'minor'? Please separate out 'priority' to fix, (because it may be a low use product' from the severity of the bug. Running as user.group=nobody.nobody isn't considered minor by any serious security professional I know, but I may keep a different crowd than you. If you at least agree with my reasoning, please compromise by readadjusting the severity back up to 'normal'... (and please explain what this submit request thing is that I'm supposed to know about), and maybe, could you explain why you started off with such an irritated tone with me? Thanks, -linda -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=542051 User sndirsch@novell.com added comment http://bugzilla.novell.com/show_bug.cgi?id=542051#c13 Stefan Dirsch changed: What |Removed |Added ---------------------------------------------------------------------------- Priority|P3 - Medium |P4 - Low Severity|Minor |Normal --- Comment #13 from Stefan Dirsch 2009-10-10 05:19:52 MDT --- mixed up severtiy/priority :-( -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=542051 Stefan Dirsch changed: What |Removed |Added ---------------------------------------------------------------------------- Summary|xfs: some minor issues |xfs runs as user nobody -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=542051 http://bugzilla.novell.com/show_bug.cgi?id=542051#c Stefan Dirsch changed: What |Removed |Added ---------------------------------------------------------------------------- Component|X.Org |X.Org Version|Final |Milestone 4 Product|openSUSE 11.1 |openSUSE 11.3 -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=542051 https://bugzilla.novell.com/show_bug.cgi?id=542051#c Stefan Dirsch changed: What |Removed |Added ---------------------------------------------------------------------------- Component|X.Org |X.Org Version|Milestone 4 |Milestone 5 of 6 Product|openSUSE 11.3 |openSUSE 11.4 -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=542051 https://bugzilla.novell.com/show_bug.cgi?id=542051#c18 Stefan Dirsch changed: What |Removed |Added ---------------------------------------------------------------------------- Status|ASSIGNED |NEEDINFO InfoProvider| |suse@tlinx.org --- Comment #18 from Stefan Dirsch 2011-09-01 14:22:01 UTC --- Unfortunately we do not have the ressources to address that issue still for openSUSE 11.4. Could you please test again with a current Milestone of openSUSE 12.1, whether the issue still exists and give me feedback about the result? Thanks. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=542051 https://bugzilla.novell.com/show_bug.cgi?id=542051#c19 Stefan Dirsch changed: What |Removed |Added ---------------------------------------------------------------------------- Status|ASSIGNED |RESOLVED Resolution| |FEATURE --- Comment #19 from Stefan Dirsch 2011-10-12 11:02:51 UTC --- Such a change should be tracked as feature request. --> https://features.opensuse.org/ Of course you can refer to this bugreport. :-) -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.