On Sunday, November 02, 2014 06:15:05 PM Lennart Poettering wrote:
On Fri, 31.10.14 10:04, Andrew Lutomirski (luto(a)mit.edu) wrote:
> I filed an FPC ticket:
https://fedorahosted.org/fpc/ticket/467
>
> Thoughts?
I very much agree with this, but I'd really prefer if we'd list what
is allowed rather than just declare what is forbidden.
A short list like this should be everything we should allow in /usr:
a) symlinks
b) directories with access mode 0555
c) files with access mode 0444 (optionally 0644 if owned by root user)
d) files with access mode 0555 (optionally 0755 if owned by root user)
e) files with access mode 2555 (optionally 2755 if owned by root user)
f) files with access mode 4555
Or something like that.
That said, there appears to be some form of cargo-cult programming
around, for example the audit packages carries a lot of non-sensical
access modes, for security theatre reasons. Good luck with getting
that package fixed!
Today's guru meditation: He who lives in glass house should not throw stones.
-Steve