Re:Sudo: Heap-based overflow with small passwords
by Beltalowda on Friday November 04, 2022 @01:23PM
(#33470383)
Being able to write to /etc/ is effectively just granting full access, since there's lots of things in there that can run code.
Doing fine-grained access is really hard; even without "root" you still have things like, say, "archive_command" in postgresql.conf which will allow running people to run arbitrary commands as the postgres user, and is that really what you want? There's lots of little things like that ranging from application configurations to crontabs to your init system.
Doing fine-grained access is really hard; even without "root" you still have things like, say, "archive_command" in postgresql.conf which will allow running people to run arbitrary commands as the postgres user, and is that really what you want? There's lots of little things like that ranging from application configurations to crontabs to your init system.