Re: removing login rights from non-overseers

[Jonathan Larmour <jifl@eCosCentric.com>]

Gerald Pfeifer wrote:
> On Thu, 10 Jun 2004, Jonathan Larmour wrote:
> 
>><fx: butts in :-)>
>>
>>Perhaps a cron job that does something like:
>>
>>8 * * * * sh -c "sleep 15 ; cd cvs ; cvs -q up gccadmin.crontab ; crontab
>>gccadmin.crontab" &
>>
>>where the cvs directory contains a checkout where CVSROOT was set to /cvs/gcc
> 
> 
> If you do it fully automatically, anyone with CVS write access can
> obtain gccadmin shell access on sourceware

Shrug... anything that involves having a gccadmin crontab which some people 
can edit, means those people have sort of shell access.

But you're right, it would help if there was CVSROOT=/cvs/gccadmin and 
suitably responsible people in a gccadmin group then :-). Or even 
CVSROOT=/home/gccadmin/cvsroot with people in the gccadmin group and 
appropriate perms. With the power of security through obscurity[1] it's 
unlikely a hacker would realise the gccadmin crontab is a way to run commands.

Sudo is a lot simpler but does mean many people still retain complete and 
interactive shell access. But it's true that either way a Bad Person can 
work out how to run arbitrary commands. The only way to stop that is with 
restricted shells/interpreters which is a slog. Although an alternative 
which may be helpful enough is if a chrooted environment for the gccadmin 
account was set up.

> (and it might interfere
> if someone, like me, is currently working on some snapshot-related
> changes).

CVS resolves conflicts better than a free-for-all.

Jifl
[1] Why does no-one ever complain that passwords are merely security 
through obscurity?
-- 
eCosCentric    http://www.eCosCentric.com/    The eCos and RedBoot experts
--["No sense being pessimistic, it wouldn't work anyway"]-- Opinions==mine