This is the mail archive of the
gdb-patches@sources.redhat.com
mailing list for the GDB project.
Re: RFC: Check permissions of .gdbinit files
Daniel Jacobowitz <drow@false.org> writes:
> On Tue, May 31, 2005 at 12:29:24AM +0200, Andreas Schwab wrote:
>> Daniel Jacobowitz <drow@false.org> writes:
>>
>> > Gentoo recently published a security update for GDB, citing the fact that
>> > GDB would load .gdbinit from the current directory even if that was owned by
>> > another user. I'm not sure how I feel about running GDB in an untrusted
>> > directory or on untrusted binaries and expecting it to behave sensibly, but
>> > this particular issue is easy to fix. Here's my suggested fix; it's not the
>> > same as Gentoo's. If .gdbinit is world writable or owned by a different
>> > user, refuse to open it (and warn the user).
>> >
>> > Anyone have opinions on this change?
>>
>> IMHO you should at least allow the same group owner.
>
> Can you explain why?
If you have a group of developers working on the same project you might
want a shared .gdbinit somewhere.
Andreas.
--
Andreas Schwab, SuSE Labs, schwab@suse.de
SuSE Linux Products GmbH, Maxfeldstraße 5, 90409 Nürnberg, Germany
Key fingerprint = 58CA 54C7 6D53 942B 1756 01D3 44D5 214B 8276 4ED5
"And now for something completely different."