[Top] [All Lists]

CVS: mhonarc/MHonArc/examples mhonarc.vim,1.14,1.15

2002-11-20 16:53:24
Update of /cvsroot/mhonarc/mhonarc/MHonArc/examples
In directory subversions:/tmp/cvs-serv8630/examples

Modified Files:
Log Message:
* New resources:
    DBFILEPERMS		File permissions for DBFILE.
    FILEPERMS		File permissions for archive files.

* Archive file creation modified to minimize the local symlink exploits:

  1.  A temp file with a random name is first created and written to.
  2.  Temp file is compressed if GZIPFILES is active.
  3.  Temp file is renamed to final filename.
  4.  File permissions are set according to FILEPERMS/DBFILEPERMS.

  Using a random temp filename makes it difficult for someone to
  predict filenames to execute a symlink exploit.  The rename operation
  is immune to symlink exploits, hence trying to using well-known names
  (e.g. maillist.html, threads.html) for exploitation will not work.

  Generation of temp files is done via the File::Temp module, if
  installed.  If not installed, a homegrown implementation is used.
  Although not as secure and robust as File::Temp, it's better than
  nothing and should provide a decent deterrent.

* Setuid/setgid execution causes mhonarc to terminate with an error.
  Mhonarc does not pass taint checks, so we abort with an error that
  setuid/setgid execution is not supported.  MHonArc is too insecure
  for setuid operation and trying to make it setuid-safe would require
  alot of work and potentially limit a large amount of functionality.

* Added check for Fcntl and File::Basename modules in FILELIST.

* Added stylesheet for documentation.  Main page docs updated to
  include class attributes to get desired rendering.  Updating
  resource reference pages will be done gradually to leverage
  style settings.  Since there is so many pages, it will be done
  on a page-by-page basis.  Maybe I can write a perl script that
  could auto-add class atteibutes where appropriate.

Index: mhonarc.vim
RCS file: /cvsroot/mhonarc/mhonarc/MHonArc/examples/mhonarc.vim,v
retrieving revision 1.14
retrieving revision 1.15
diff -C2 -r1.14 -r1.15
*** mhonarc.vim	17 Nov 2002 03:38:52 -0000	1.14
--- mhonarc.vim	20 Nov 2002 23:53:11 -0000	1.15
*** 58,61 ****
--- 58,62 ----
  syn keyword mhaTagName contained daybegin
  syn keyword mhaTagName contained dayend
+ syn keyword mhaTagName contained dbfileperms
  syn keyword mhaTagName contained decodeheads
  syn keyword mhaTagName contained nodecodeheads
*** 72,75 ****
--- 73,77 ----
  syn keyword mhaTagName contained fieldsend
  syn keyword mhaTagName contained fieldstyles
+ syn keyword mhaTagName contained fileperms
  syn keyword mhaTagName contained firstpglink
  syn keyword mhaTagName contained fldbeg

To sign-off this list, send email to majordomo(_at_)mhonarc(_dot_)org with the