/www/conf/httpd.conf

[Jason Molenda]

On Wed, May 07, 2003 at 05:06:33PM -0400, Christopher Faylor wrote:

> I keep meaning to look into checking httpd.conf into cvs.  There's no
> real reason why we couldn't just put this in, say,
> /sourceware/infra/httpd or something and use the standard mechanism
> for updating it right?

You could compromise the system if you could write to the httpd.conf
file, so the current scheme where only people with ssh login access
as root can write it keeps that group small.  Otherwise, no, no
problems.  I suppose if you've compromised an account with sourceware
repo write access, you've probably already got login access.  Compromising
the httpd uid could give you group write perms to all the other 
groups (granted for cvsweb).

I doubt this would represent our most gregarious security problem--I'm
just thinking it through aloud.

J