Schlomo Schapiro wrote:
Ludwig Nussel wrote:
Schlomo Schapiro wrote:
Ludwig Nussel wrote:
Hmm, Ludwig, what about these permissions? Are they still needed? Well, you tell me :-) Those binaries are usually setgid games for writing shared highscore files in /var. I'd be happy to get rid of the setgid bits by default. Could this not be also done via a suitable setup of the highscore directory with ACLs and setgid on the directory? Make it group writeable for all users and make sure that the default ACLs are set correctly?
That wouldn't increase security. Those games are not written with security in mind so having access to highscore files could allow a local attacker to do nasty things. Best way would be to have the highscore files written via daemon.
I agree 100%. But my point was rather that I believe that the question of multi-user high score files is not really that important to 99.999% of our users and those, to whom it matters, surely will be able to deal with it adequately.
So that as a practical solution for openSUSE I would suggest to simply drop the permissions and leave it to the interested admin to deal with the issue.
Sure. That might require some fixes in games that expect the highscore file writeable though. The following games need to be checked if we want to remove the setgid bit: /usr/games/atc games:games 2755 /usr/games/battlestar games:games 2755 /usr/games/canfield games:games 2755 /usr/games/cribbage games:games 2755 /usr/games/phantasia games:games 2755 /usr/games/robots games:games 2755 /usr/games/sail games:games 2755 /usr/games/snake games:games 2755 /usr/games/tetris-bsd games:games 2755 /usr/games/Maelstrom games:games 2755 /usr/games/pachi games:games 2755 /usr/games/martian games:games 2755 /usr/lib/nethack/nethack.tty games:games 2755 /usr/games/chromium games:games 2755 /usr/games/xscrab games:games 2755 /usr/games/trackballs games:games 2755 /usr/games/ltris games:games 2755 /usr/games/xlogical games:games 2755 /usr/games/lbreakout2 games:games 2755 /usr/bin/xgalaga games:games 2755 /usr/games/rocksndiamonds games:games 2755 /usr/bin/glines games:games 2755 /usr/bin/gnibbles games:games 2755 /usr/bin/gnobots2 games:games 2755 /usr/bin/gnometris games:games 2755 /usr/bin/gnomine games:games 2755 /usr/bin/gnotravex games:games 2755 /usr/bin/gnotski games:games 2755 /usr/bin/gtali games:games 2755 /usr/bin/mahjongg games:games 2755 /usr/bin/same-gnome games:games 2755 Now we only need a volunteer to try them out and file bugs if necessary :-) cu Ludwig -- (o_ Ludwig Nussel //\ V_/_ http://www.suse.de/ SUSE LINUX Products GmbH, GF: Markus Rex, HRB 16746 (AG Nuernberg) -- To unsubscribe, e-mail: opensuse-packaging+unsubscribe@opensuse.org For additional commands, e-mail: opensuse-packaging+help@opensuse.org