3 ms·
Setting a capability on the perl executable seems like a very bad idea. That effectively grants tha capability to everything that is able to invoke perl (withou
by thayne 11mo ago
Setting a capability on the perl executable seems like a very bad idea. That effectively grants tha capability to everything that is able to invoke perl (without being restricted to NO_NEW_PRIVILEGES).
- aftbit 11mo agoYeah why did he want non-root perl to be able to bind to low-numbered ports? Seems like one of those typical footguns of applying non-standard configurations.
- thayne 11mo agoMy reading is the author didn't do that, rather his/her employers configuration system had done so. Setting TMPDIR to /mnt/tmp seems also to come from that. I would guess both were the result of someone who didn't really know what they were doing trying things until they found something that got what they needed to work, then pushed that out without understanding the broader implications.