perms of /dev/uhid0
piechota at argolis.org
Wed Nov 26 08:36:13 PST 2003
On Wed, 26 Nov 2003, Mike Tancsa wrote:
> I know for our setup, there is nothing else that would need to talk to this
> device so I could do something like that. Not sure of the implications if
> someone unplugged the UPS and put their own device into the port. The
> physical server is in a locked box, but the UPS is not. So if they somehow
> managed to blow up the daemon by overflowing a buffer, it would be nice
> that its a non root user. However, I do not try and read more than
> sizeof(buffer) so I dont see any obvious ways...
Looking at /etc/usbd.conf, it appears that you can specify what USB Manuf
and Device ID the UPS is, so it'd only chgrp stuff when the device was the
UPS. I suppose that wouldn't stop someone who changed their device IDs to
match the UPS, but that seems like a minimal risk.
More information about the freebsd-security