Mailing Lists: Apple Mailing Lists
Image of Mac OS face in stamp
 
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: Error -3212 ???

on 6/13/01 10:32 AM, Peter Sichel <email@hidden> wrote:

> Another problem is you don't really want your entire server app
> to be SUID root as this has significant security implications.
> In order to have an SUID root companion open the port for you and
> pass back an open socket you need to use native BSD calls.
> There's no easy way to wrap an OT endpoint around a BSD
> open socket.

Why not make with the application SUID root, then once the application gets
started and is past the point where it needs root privileges, have it change
its UID and GID to something more restrictive (such as "nobody")? Or, simply
require that the application must be started by a process with root
privileges (a user logged in as root, for example), and in this case also
make sure the server sets its own UID and GID to something restrictive (as
is done with the Apache web server, if I recall correctly).

/c

References: 
 >Re: Error -3212 ??? (From: Peter Sichel <email@hidden>)



Visit the Apple Store online or at retail locations.
1-800-MY-APPLE

Contact Apple | Terms of Use | Privacy Policy

Copyright © 2007 Apple Inc. All rights reserved.