Posted by Jason Wong on 02/10/05 20:13

On Thursday 10 February 2005 11:58, Niels wrote:
> Richard Lynch wrote:
> > Perhaps the reason there is no article or tutorial is that it would
> > be a book, not an article or tutorial :-)
> >
> > There are so MANY affected/related software system pieces that you
> > can't do it justice in an article or tutorial, I suspect.
>
> Quite true. However, warnings about "don't do this or that", "an
> attacker may use this" and so on are numerous, but advice on what to do
> about it is rarer. And this thing with system calls is a good example:
> I can find many warnings about not doing it, but not a single piece of
> advice about how to do it when it's actually necessary.

To put it simply you would have to check *extremely* carefully the user
input to ensure that it is not malicious, and that it is what it should
be. I believe your original problem was about writing procmail files. So
in that particular instance, in the extreme case you may have to write a
complete procmail parser in php to ensure that what the user is entering
is at least (i) a genuine procmail compliant file, and possibly (ii)
isn't going to harm your system in anyway. You're not going to find many
books or articles that will tell you how to write a complete procmail
parser, that's why they're hard to find, and ditto for whatever else you
want your sudo to be doing.

--
Jason Wong -> Gremlins Associates -> www.gremlins.biz
Open Source Software Systems Integrators
* Web Design & Hosting * Internet & Intranet Applications Development *
------------------------------------------
Search the list archives before you post
http://marc.theaimsgroup.com/?l=php-general
------------------------------------------
New Year Resolution: Ignore top posted posts

[Back to original message]