2 ms·
why is it running as root anyway? should probably setuid to the correct user and do the thing there instead
by blibble 3y ago
why is it running as root anyway?
should probably setuid to the correct user and do the thing there instead
- Avamander 3y agoWell in some cases avoiding root might help. But you can have flaws like this root or not, for example Apache httpd still has a known TOCTOU vulnerability with symlinks with a broken check (SymlinksIfOwnerMatch does not actually work).