Re: [gentoo-dev] net-mail/mailman-2.1.9-r2: Request for testing

[Wolfram Schlich <wschlich@gentoo.org>]

* Wolfram Schlich <wschlich@gentoo.org> [2007-11-27 02:31]:
> * Wolfram Schlich <wschlich@gentoo.org> [2007-11-27 02:24]:
> > * Hanno Böck <hanno@gentoo.org> [2007-11-26 15:39]:
> > > [...]
> > > So I'd like to unmask it soon. Please, if you're using mailman test it, tell 
> > > me if it suits your needs or just give me feedback like "worksforme", I 
> > > actually don't have a clue how many people really use this ebuild.
> > 
> > I get this using hardened-sources with activated grsecurity
> > trusted path execution feature:
> > 
> > 2007-11-27 02:15:47 +01:00; alpha; kern.alert; kernel: grsec: From 127.0.0.6: \
> > 	denied untrusted exec of /usr/lib/mailman/bin/mmsitepass by \
> > 	/bin/bash[bash:14178] uid/euid:280/280 gid/egid:280/280, \
> > 	parent /bin/bash[bash:14173] uid/euid:280/280 gid/egid:280/280
> > 
> > That's because /usr/lib/mailman/bin/ is group-writable.
> 
> Ok, that's not true :]
> 
> Using this configuration...
> --8<--
> CONFIG_GRKERNSEC_TPE=y
> # CONFIG_GRKERNSEC_TPE_ALL is not set
> CONFIG_GRKERNSEC_TPE_INVERT=y
> CONFIG_GRKERNSEC_TPE_GID=1005
> --8<--
> ...I have to add 'mailman' to group 1005.

Ok, it get's worse: for the mailman webinterface, I'd have to add
'apache' to group 1005 as well, opening up even bigger holes.
No way! So, emerge -C mailman, that is :(
Too bad.
-- 
Regards,
Wolfram Schlich <wschlich@gentoo.org>
Gentoo Linux * http://dev.gentoo.org/~wschlich/
--
gentoo-dev@gentoo.org mailing list