Hi Arne, Arne Wichmann <[email protected]> writes: > Specifically the configuration file and whitelist file should default to a > user-accessible place. > > Reasoning: debsecan does not need to be run as root for any of its > functionality, so it should not be run as root.
I agree that debsecan should not be run as root, but I fail to see how that can be automatically set up in such a way that users can access the configuration file and whitelist: Assume we make the config+whitelist world-writeable. This poses a security threat, because any user on your system may now modify what the sysadmin sees in the report (and thereby hide vulnerabilities). Assume we introduce a new user account (e.g. “debsecan”) owning the config+whitelist. Now your user (e.g. “aw”) doesn’t have permission to edit the config+whitelist. Can you elaborate on what you had in mind please? -- Best regards, Michael
