Search the Community
Showing results for tags 'security'.
Found 2 results
-
I note that on my server machine, the files in /Library/Application support have what I consider the wrong permissions. Most of the files here are owned by root, but the bundles and their contents are owned by the user who installed the engine. It is a security problem to allow a "normal" user to manipulate these files directly. (first cd "/Library/Application support") virtue:Retrospect sysadmin$ ls -al total 30736 drwxrwxr-x 19 root admin 646 Aug 12 19:52 . drwxr-xr-x 20 root admin 680 Apr 15 11:45 .. -rw-rw-r--@ 1 donlee admin 6148 Oct 6 2011 .DS_Store drwxrwxrwx 3 root admin 102 Apr 3 15:45 Catalogs -rwxr-xr-x 1 root admin 1488072 Aug 12 18:13 Config80.bak -rwxr-xr-x 1 root admin 7731400 Aug 13 02:37 Config80.dat -rwxr-xr-x 1 root admin 86988 Jul 12 17:21 ConfigISA.bak -rwxr-xr-x 1 root admin 86988 Jul 12 17:21 ConfigISA.dat drwxrwxr-x 3 donlee staff 102 Jul 4 10:41 RetrospectEngine.bundle drwxrwxr-x 3 donlee staff 102 Jul 4 10:41 RetrospectInstantScan.bundle drwxr-xr-x 4 root admin 136 Aug 13 02:37 RtrExec.dir drwxr-xr-x 2 root admin 68 Apr 4 13:36 RtrISAExec.dir drwxr-xr-x 3 root admin 102 Apr 3 15:43 RtrSec.dir -rwxr-xr-x 1 root admin 120003 Aug 12 19:52 assert_log.utx -rwxr-xr-x 1 root admin 6171156 Aug 13 02:37 operations_log.utx -rwxrwxr-x 1 root admin 211 Aug 12 19:53 retro.ini -rwxr-xr-x 1 root admin 18466 Jul 12 17:21 retroISA_log.utx -rwxrwxr-x@ 1 root admin 195 Jul 12 17:21 retro_isa.ini -rw-r--r-- 1 root admin 0 Jul 11 05:00 uuid_temp.log virtue:Retrospect sysadmin$ ls -al Retro* RetrospectEngine.bundle: total 0 drwxrwxr-x 3 donlee staff 102 Jul 4 10:41 . drwxrwxr-x 19 root admin 646 Aug 12 19:52 .. drwxrwxr-x 4 donlee staff 136 Jul 4 10:41 Contents RetrospectInstantScan.bundle: total 0 drwxrwxr-x 3 donlee staff 102 Jul 4 10:41 . drwxrwxr-x 19 root admin 646 Aug 12 19:52 .. drwxrwxr-x 4 donlee staff 136 Jul 4 10:41 Contents virtue:Retrospect sysadmin$
- 3 replies
-
- 1
-
-
- engine
- permissions
- (and 2 more)
-
I try to do my installs with a "system" user who owns and installs all of the applications. In general, I can set all of the applications to read-only, so that even a user who does something pretty dumb can't do much damage. This is also something that is commonly done with enterprise setups, where "approved" applications are kept on a network server, and are strictly read-only because they are shared among many users. The Retrospect console is a single application, and when it is installed according to the implied instructions on the installer disk, the single app is placed in a folder in the /Applications folder, and on first run, parts of that application are moved from the bundle to the folder. Two problems with this: 1. The files so moved are set up with "0777" permissions - that is world read/write/execute. This means that anyone on the system can scribble on them, remove them, rename them, or otherwise screw them up. If I am trying to keep my machine relatively secure this is "bad". 2. If I install the Retrospect console as "admin" and then first launch it as a normal user, these files are not moved from the bundle. I have not yet explored what this means, but it is clear that the difference in behavior will be puzzling to someone in addition to me. My suggestion is that the application should definitely be set up so that if I want to have the folder and all its content be read-only, it should be possible. Bonus points if it is also easy. If the ease of installation of having the bundle contents in the app is important, the step of moving the components to the enclosing folder should be explicit and should request authorization explicitly rater than simply failing as it does now.
