Re: NO! Re: [PATCHES] Two fixes for lpd/lpc for review and test

2000-01-12 Thread Garance A Drosihn
Back on December 27, 1999, Garance A Drosihn wrote: >At 8:55 AM -0500 12/24/99, Robert Watson wrote: >>For example, imagine that the user has a >>number of hard links to the file in question. > > Okay, here's my newer version of the code, which takes > into account multiple hard links, and also ma

Re: NO! Re: [PATCHES] Two fixes for lpd/lpc for review and test

1999-12-27 Thread Garance A Drosihn
At 8:55 AM -0500 12/24/99, Robert Watson wrote: >For example, imagine that the user has a >number of hard links to the file in question. Okay, here's my newer version of the code, which takes into account multiple hard links, and also makes it so the spooled data file is owned by daemon instead o

Re: NO! Re: [PATCHES] Two fixes for lpd/lpc for review and test

1999-12-27 Thread Garance A Drosihn
At 8:55 AM -0500 12/24/99, Robert Watson wrote: >... keep in mind that this optimization does not produce behavior >behavior in some cases. For example, imagine that the user has a >number of hard links to the file in question. If the file is copied and >then deleted, then the link count is decr

Re: NO! Re: [PATCHES] Two fixes for lpd/lpc for review and test

1999-12-24 Thread Robert Watson
This is not a comment on your code, which I have not inspected yet, but instead on the idea of the optimization. This is probably not a serious objection, but keep in mind that this optimization does not produce identical behavior in some case. For example, imagine that the user has a number o

Re: NO! Re: [PATCHES] Two fixes for lpd/lpc for review and test

1999-12-23 Thread Garance A Drosihn
At 2:33 AM -0800 12/10/99, Alfred Perlstein wrote: >Can someone take a look at this? > >Basically, it makes the link to the file, if it can unlink the original >it will then chown the spool file if it can't delete or read the original >then the user didn't have permission and it backs out. Okay,

Re: NO! Re: [PATCHES] Two fixes for lpd/lpc for review and test

1999-12-10 Thread Garance A Drosihn
At 7:24 PM +0100 12/10/99, Andre Albsmeier wrote: >On Fri, 10-Dec-1999 at 13:16:16 -0500, Garance A Drosihn wrote: > > I'm thinking you'd what to add an lstat call after creating the > > hardlink. Check the new file to see if it's a symlink, and if it > >Can a symlink be created by link() ? If I

Re: NO! Re: [PATCHES] Two fixes for lpd/lpc for review and test

1999-12-10 Thread Alfred Perlstein
On Fri, 10 Dec 1999, Garance A Drosihn wrote: > At 2:33 AM -0800 12/10/99, Alfred Perlstein wrote: > >Can someone take a look at this? > > > >Basically, it makes the link to the file, if it can unlink the original > >it will then chown the spool file if it can't delete or read the original > >the

Re: NO! Re: [PATCHES] Two fixes for lpd/lpc for review and test

1999-12-10 Thread Andre Albsmeier
On Fri, 10-Dec-1999 at 13:16:16 -0500, Garance A Drosihn wrote: > At 2:33 AM -0800 12/10/99, Alfred Perlstein wrote: > >Can someone take a look at this? > > > >Basically, it makes the link to the file, if it can unlink the original > >it will then chown the spool file if it can't delete or read th

Re: NO! Re: [PATCHES] Two fixes for lpd/lpc for review and test

1999-12-10 Thread Garance A Drosihn
At 2:33 AM -0800 12/10/99, Alfred Perlstein wrote: >Can someone take a look at this? > >Basically, it makes the link to the file, if it can unlink the original >it will then chown the spool file if it can't delete or read the original >then the user didn't have permission and it backs out. I'm th

Re: NO! Re: [PATCHES] Two fixes for lpd/lpc for review and test

1999-12-10 Thread Alfred Perlstein
On Fri, 10 Dec 1999, Andre Albsmeier wrote: > On Thu, 09-Dec-1999 at 15:02:41 -0800, Alfred Perlstein wrote: > > On Thu, 9 Dec 1999, Andre Albsmeier wrote: > > > > ... > > > > > For better reference, here is the current patch: > > > > > > > I don't have too much time to think about this, argue

Re: NO! Re: [PATCHES] Two fixes for lpd/lpc for review and test

1999-12-09 Thread Andre Albsmeier
On Thu, 09-Dec-1999 at 15:02:41 -0800, Alfred Perlstein wrote: > On Thu, 9 Dec 1999, Andre Albsmeier wrote: > > ... > > > For better reference, here is the current patch: > > > > *** lpr.c.ORI Thu Dec 9 15:30:18 1999 > > --- lpr.c Thu Dec 9 15:30:35 1999 > > *** > > *** 370

Re: NO! Re: [PATCHES] Two fixes for lpd/lpc for review and test

1999-12-09 Thread Andre Albsmeier
On Tue, 07-Dec-1999 at 14:55:37 -0800, Alfred Perlstein wrote: I think the (really big) security hole can be closed by not doing the chown/chmod commands. I inserted them because I wanted the file in the spool directory to appear exactly as if lpr would have copied it. I am currently running the

NO! Re: [PATCHES] Two fixes for lpd/lpc for review and test

1999-12-07 Thread Alfred Perlstein
On Tue, 7 Dec 1999, Warner Losh wrote: > I've been reviewing this patch with someone and I think the last > version is ready to commit. I'll take a look at my tree to make > sure. please do not, the patch in PR 11997 introduces a major security flaw. someone can hardlink to any file and clobbe