10 ms·
My favourite bit from the (as always, impressive) changelog: For additional security, security(8) was rewritten in Perl.
by copper 15y ago
My favourite bit from the (as always, impressive) changelog:
For additional security, security(8) was rewritten in Perl.
- petsos 15y agoWhat was the language of the previous version?
- there 15y agoshell script
- thomasknowles 15y agohttp://www.openbsd.org/plus50.html http://www.openbsd.org/plus50.html > Switched from the old shell script /etc/security to the new Perl script security(8).
- ez77 15y agoThat reason seems pretty shallow coming from the OBSD team... How can changing the language make it more secure by itself? Is a rewrite in C the next planned enhancement?
- tedunangst 15y agoperl has better support for symbolic file name and directory traversal.
- KaeseEs 15y agoIs security(8) setuid? perl does a number of things to make setuid Perl scripts more secure than either setuid schell scripts or C programs (cf. taint mode).
- there 15y agono, security is run from /etc/daily, which is run by root's crontab every day at 0130.
- ez77 15y agoAt the risk of dumping yet more karma, let me rephrase more constructively. OpenBSD has focused on security from the beginning. Precisely for that reason, and considering all the audits they run, it feels like, if OpenBSD has used (up to 4.9) shell scripts for security(8), there mustn't be any compelling reason against using the shell. Surely they must not have them. I realize this was a changelog and not an article, and probably due reasons were found and discussed by the team. I still feel, nonetheless, that "For additional security, security(8) was rewritten in Perl" is either too short (provide a brief reason such tedunangst's) or too long (omit half-baked reasons and simply provide the fact that "security(8) was rewritten in Perl").
- priteau 15y agoFrom the CVS log 7 months ago: Work in progress to replace /etc/security, not yet linked to the build. Main design goals: 1. Safely handle untrusted file names and file content. 2. Output compatibility with current security(8) to please people parsing the output with scripts (except when improving functionality right away saves considerable implementation effort). Substantial functional enhancements are for later. Prodding to do this in Perl by deraadt@. Using some feedback from espie@. http://www.openbsd.org/cgi-bin/cvsweb/src/libexec/security/security http://www.openbsd.org/cgi-bin/cvsweb/src/libexec/security/s...