httpd-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Randy Terbush <ra...@zyzzyva.com>
Subject Re: Time's a wastin'
Date Tue, 24 Sep 1996 01:28:07 GMT
> Jason A. Dour wrote:
> > 
> > -----BEGIN PGP SIGNED MESSAGE-----
> > 
> > On Mon, 23 Sep 1996, Jim Jagielski wrote:
> > > I have the patch, and it's "required" by many multi-group OSs.
> > > I'll commit
> > 
> > 	How so?  I can't see how it would be a "requirement"...  Please
> > explain.  Sorry to be redundant, please excuse me.  ;)
> > 
> 
> the can_exec() call should check each possible group, instead of the
> default. Thus, if the OS uses multiple groups, then Apache should support
> that.

I see your argument. Do you see the reason that Jason and I decided not
to support multiple groups in setuid() execution?

I don't necesarily want Joe Blow running my CGI program as _me_ just
because we both happen to be in group www (unbeknownst to me) and I
was stupid enough to leave the group x-bit set.










Mime
View raw message