hi

just curious, my /var/crash directory is 777 mode. Can i set it to 700? or do
other users need to use this directory ? thanks....

mike wrote:

> just curious, my /var/crash directory is 777 mode. Can i set it to 700? or do
> other users need to use this directory ? thanks....

It's not installed that way.

If /var/crash is 777 then regular user could 'mkdir /var/crash/stuff' and
keep data there - not what you want.

If /var/crash/`uname -n` allows access to regular users (or really to any
vmcore.* files in there) then that's a security issue.  Kernel crash dumps
(even if you don't set them to dump user pages too) can include information
that a user should not be able to see - eg if userA was writing some sensitive
file to disk as the system crashed then userB may be able to see some buffers
of that file in the crash dump.

Gavin

In article <c9mv16$66q$1@new-usenet.uk.sun.com>,
Gavin Maltby  <g_a_v_i_n.m_a_l_t_b_y@s_u_n.com> wrote:
>mike wrote:
>
>> just curious, my /var/crash directory is 777 mode. Can i set it to 700? or do
>> other users need to use this directory ? thanks....
>
>It's not installed that way.
>
>If /var/crash is 777 then regular user could 'mkdir /var/crash/stuff' and
>keep data there - not what you want.
>
>If /var/crash/`uname -n` allows access to regular users (or really to any
>vmcore.* files in there) then that's a security issue.  Kernel crash dumps
>(even if you don't set them to dump user pages too) can include information
>that a user should not be able to see - eg if userA was writing some sensitive
>file to disk as the system crashed then userB may be able to see some buffers
>of that file in the crash dump.
>
>Gavin

On Solaris 8 /var/crash is installed as 755.  If you have a crash, there
will be a subdirectory in /var/crash which is created mode 700.
-- 
Tom Schulz
schulz@adi.com