Re: Fixing a security hole in mount table.

2003-09-09 Thread Corinna Vinschen
On Mon, Sep 08, 2003 at 09:11:34PM -0400, Christopher Faylor wrote: > On Mon, Sep 08, 2003 at 08:46:06PM -0400, Pierre A. Humblet wrote: > >This is the first in a series of patches fixing security holes > >associated with the file mappings in the core of Cygwin. > >I hope the explanations below are

Re: Fixing a security hole in mount table.

2003-09-09 Thread Pierre A. Humblet
Christopher Faylor wrote: > > On Tue, Sep 09, 2003 at 12:12:11AM -0400, Pierre A. Humblet wrote: > >At 09:11 PM 9/8/2003 -0400, you wrote: > >>On Mon, Sep 08, 2003 at 08:46:06PM -0400, Pierre A. Humblet wrote: > >>>This is the first in a series of patches fixing security holes > >>>associated with

Re: Fixing a security hole in mount table.

2003-09-09 Thread Pierre A. Humblet
Corinna Vinschen wrote: > > On Mon, Sep 08, 2003 at 09:11:34PM -0400, Christopher Faylor wrote: > > On Mon, Sep 08, 2003 at 08:46:06PM -0400, Pierre A. Humblet wrote: > > >This is the first in a series of patches fixing security holes > > >associated with the file mappings in the core of Cygwin. >

RE: Fixing a security hole in mount table.

2003-09-09 Thread Gary R Van Sickle
> Christopher Faylor wrote: > > > I wonder if it is time to bite the bullet and get rid of user-mode > > mounts entirely. Or maybe disallow them in suid'ed sessions? They > > are always going to be a security hole AFAICT. > > I think that would be a bad idea. What if I want to install > a pri

Part 2 of Fixing a security hole in mount table.

2003-09-09 Thread Pierre A. Humblet
This is the follow up on yesterday's patch. There is no change in external behavior, just cleaning up. The main innovation is the new function cygheap_user::init that initializes the user name and sid just after the cygheap is initialized. The information can then be used in user_shared_initiali