http://bugzilla.novell.com/show_bug.cgi?id=578621 http://bugzilla.novell.com/show_bug.cgi?id=578621#c1 Karl Eichwalder changed: What |Removed |Added ---------------------------------------------------------------------------- Target Milestone|--- |Milestone 5 --- Comment #1 from Karl Eichwalder 2010-03-30 08:47:29 UTC --- Thanks for the draft! I basically keep it: Samba: mount.cifs no longer setuid root The mount.cifs program that is being used to mount Samba/ CIFS shares will not be allowed to be run as a setuid root program. mount.cifs has been the subject of several security bugs that have arisen due to some of the users using it as a setuid root program. For e.g., tools like smb4k on the distribution require mount.cifs setuid root. So there is a chance that users of such tools set the setuid bit. This program has not been properly audited for security and the Samba team strongly recommends that it not be installed as a setuid root program at this time. To make that very clear, this release forcibly disables the ability for mount.cifs to run as a setuid root program. People are welcome to trivially patch this out, by setting CIFS_DISABLE_SETUID_CHECK to 1, but they do so at their own peril. A security audit and redesign of this program is in progress by the Samba Team. =========================================================== With xml tags: <!-- bnc#578621 --> <sect3 id="sec.113.mount.cifs"> <title>Samba: mount.cifs no longer setuid root</title> <para>The <command>mount.cifs</command> program that is being used to mount Samba/CIFS shares will not be allowed to be run as a setuid root program. mount.cifs has been the subject of several security bugs that have arisen due to some of the users using it as a setuid root program. For e.g., tools like smb4k on the distribution require <command>mount.cifs</command> setuid root. So there is a chance that users of such tools set the setuid bit. This program has not been properly audited for security and the Samba team strongly recommends that it not be installed as a setuid root program at this time.</para> <para>To make that very clear, this release forcibly disables the ability for <command>mount.cifs</command> to run as a setuid root program. People are welcome to trivially patch this out, by setting <systemitem>CIFS_DISABLE_SETUID_CHECK</systemitem> to <literal>1</literal>, but they do so at their own peril.</para> <para>A security audit and redesign of this program is in progress by the Samba Team.</para> </sect3> -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.