This is the mail archive of the gdb-patches@sources.redhat.com mailing list for the GDB project.


Index Nav: [Date Index] [Subject Index] [Author Index] [Thread Index]
Message Nav: [Date Prev] [Date Next] [Thread Prev] [Thread Next]
Other format: [Raw text]

Re: RFC: Check permissions of .gdbinit files


Daniel Jacobowitz <drow@false.org> writes:

> On Tue, May 31, 2005 at 12:29:24AM +0200, Andreas Schwab wrote:
>> Daniel Jacobowitz <drow@false.org> writes:
>> 
>> > Gentoo recently published a security update for GDB, citing the fact that
>> > GDB would load .gdbinit from the current directory even if that was owned by
>> > another user.  I'm not sure how I feel about running GDB in an untrusted
>> > directory or on untrusted binaries and expecting it to behave sensibly, but
>> > this particular issue is easy to fix.  Here's my suggested fix; it's not the
>> > same as Gentoo's.  If .gdbinit is world writable or owned by a different
>> > user, refuse to open it (and warn the user).
>> >
>> > Anyone have opinions on this change?
>> 
>> IMHO you should at least allow the same group owner.
>
> Can you explain why?

If you have a group of developers working on the same project you might
want a shared .gdbinit somewhere.

Andreas.

-- 
Andreas Schwab, SuSE Labs, schwab@suse.de
SuSE Linux Products GmbH, Maxfeldstraße 5, 90409 Nürnberg, Germany
Key fingerprint = 58CA 54C7 6D53 942B 1756  01D3 44D5 214B 8276 4ED5
"And now for something completely different."


Index Nav: [Date Index] [Subject Index] [Author Index] [Thread Index]
Message Nav: [Date Prev] [Date Next] [Thread Prev] [Thread Next]