Re: [sipX-dev] Input on XCF-651 implementation (Restore page from sipXconfig UI)
On Tue, 03 Apr 2007 13:42:26 -0400, Paul Mossman <paul.mossman@xxxxxxxxx> wrote:
> 3. I see that the script will need to be run as root in order to have
> the permissions to stop/restart the services and do the actual
> restore. A user who has logged in a superadmin may find it strange to
> subsequently provide root credentials in order to perform a Restore.
> So I'm wondering if we can avoid this, perhaps with setuid on the
> script for instance.
setuid on scripts is rarely a good idea, they are an easy vector for security
problems.
sudo is a better answer for not needing to provide root credentials, and it can
be locked down to allow only that script to be run if desired.
--Woof!
