Dependency reciprocity : real world problem with httpd and httpd-suexec
Alan Cox
alan at redhat.com
Tue Sep 7 21:28:25 UTC 2004
On Tue, Sep 07, 2004 at 01:57:37PM -0700, Steve G wrote:
> >The problem is that during the transaction, httpd-suexec (which got pulled
> >in as a dependency) got installed first, outputting the message "apache
> >group doesn't exist, using root"... BAD!
>
> Really bad. I would think this bug needs fast attention. If you download a
> package from a 3rd party that has buffer overflows and is setgid, you now have a
> buggy program with buffer overflows running as root. Any setgid installation that
> fails should never revert to root, it should fail immediately and let the admin
> take care of it.
Not sure about that - it should certainly not set the setuid bit, but its
probably easier for the admin if it still installs it.
> Was this filed in bugzilla?
Ditto Q: and bug id ?
More information about the fedora-devel-list
mailing list