From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Date: Mon, 27 Jun 2005 15:29:01 +0400 From: Alexey Tourbin To: Sisyphus Message-ID: <20050627112900.GL31585@solemn.turbinal.org> Mail-Followup-To: Sisyphus References: <20050626090644.GB31585@solemn.turbinal.org> <200506271303.25973.serpiph@nikiet.ru> <20050627095346.GK31585@solemn.turbinal.org> <200506271455.45144.serpiph@nikiet.ru> Mime-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="iK/wEI4vkfDmI6Zw" Content-Disposition: inline In-Reply-To: <200506271455.45144.serpiph@nikiet.ru> Subject: [sisyphus] Re: Q: perl security, CPAN security X-BeenThere: sisyphus@altlinux.ru X-Mailman-Version: 2.1.5 Precedence: list Reply-To: ALT Linux Sisyphus discussion list List-Id: ALT Linux Sisyphus discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 27 Jun 2005 11:30:24 -0000 Archived-At: List-Archive: --iK/wEI4vkfDmI6Zw Content-Type: text/plain; charset=koi8-r Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Mon, Jun 27, 2005 at 02:55:44PM +0400, Epiphanov Sergei wrote: > =E1 =DE=D4=CF =D7 =CC=C5=D3, =DE=D4=CF =D0=CF =C4=D2=CF=D7=C1. =E9=D3=CB= =C1=D4=D8 =CE=D5=D6=CE=D9=CA =D4=C5=CB=D3=D4 =D3=D2=C5=C4=C9 =CB=D5=DE=C9 w= arning'=CF=D7 =C9=CE=CF=C7=C4=C1=20 > =CE=C5 =CC=C5=C7=DE=C5 =CE=C1=D3=D4=D2=CF=CA=CB=C9 =C9=DA-=DA=C1 -T. =E1 = =D5=D6 =CB=C1=CB apache =CE=C1 =D4=C5=D3=D4=CF=D7=CF=CA =CD=C1=DB=C9=CE=C5 = =CF=C2=D2=C1=C4=D5=C5=D4=D3=D1=20 > (=D0=D2=CF=D7=C5=D2=CB=C1 =C4=C1=D4, =CF=CB=D2=D5=D6=C5=CE=C9=D1, =D0=D2= =CF=C2=CF=D7=C1=D4=D8 =C4=CF=D3=D4=D5=DE=C1=D4=D8=D3=D1 =C4=CF =C6=C1=CA=CC= =CF=D7, ... ). :) =F7=D9 =D0=CF=CE=C9=CD=C1=C5=D4=C5, =DE=D4=CF =DC=D4=CF *=D4=CF=CC=D8=CB=CF= =C4=CC=D1 =D2=D5=D4=C1* =D0=D2=C5=C4=CC=C1=C7=C1=C5=D4=D3=D1 =D3=C4=C5=CC= =C1=D4=D8? =F5 =D7=C1=D3 apache =C9=D3=D0=CF=CC=CE=D1=C5=D4 =D0=C5=D2=CC=CF=D7=D9=CA = =CB=CF=C4 =D3 =D0=D2=C1=D7=C1=CD=C9 =D2=D5=D4=C1? > > $ perl test.pl arg > > /usr/bin/=CB=CF=CD=C1=CE=C4=C1 'arg' > > $ perl test.pl arg\'\;rm\ -rf\ \'/ > > /usr/bin/=CB=CF=CD=C1=CE=C4=C1 'arg';rm -rf '/' > > $ >=20 > =EE=CF =DC=D4=C9 =D6=C5 =CB=CF=CD=C1=CE=C4=D9 =F7=D9 =CE=C1=C2=C9=D2=C1= =C5=D4=C5 =D3=C1=CD=C9! =F3=D4=C1=CC=CF =C2=D9=D4=D8, =CD=CF=D6=CE=CF =D0= =D2=CF=D7=C5=D2=C9=D4=D8 =DE=D4=CF=20 > =CE=C1=C2=C9=D2=C1=C5=D4=C5. =F0=CF=D7=D4=CF=D2=D1=C0: =C4=CC=D1 _=CC=C9= =DE=CE=CF=C7=CF_ =D0=CF=CC=D8=DA=CF=D7=C1=CE=C9=D1. =F1 =D0=C9=DB=D5 =D0=CF= =C4=CF=C2=CE=CF=C5 =C4=CC=D1=20 > =CF=C2=D2=C1=C2=CF=D4=CB=C9 =F3=F7=EF=E9=E8 =C6=C1=CA=CC=CF=D7 =D7 =CB=C1= =D4=C1=CC=CF=C7=C5, =D0=D2=C5=C4=D7=C1=D2=C9=D4=C5=CC=D8=CE=CF =D0=D2=CF=D3= =CD=CF=D4=D2=C5=D7 =CE=C1=D0=C9=D3=C1=CE=C9=C5 =C9=C8=20 > =C9=CD=A3=CE. =EF=C4=CE=C1=CB=CF =D6=C5 =D0=CF=CC=CE=CF=CD=CF=DE=C9=D1 =D2=D5=D4=C1 =D7= =D9=C8=CF=C4=D1=D4 =DA=C1 =D0=D2=C5=C4=C5=CC=D9 =F3=F7=EF=E9=E8 =C6=C1=CA= =CC=CF=D7 =D7 =CB=C1=D4=C1=CC=CF=C7=C5. =F7 =D3=D5=DD=CE=CF=D3=D4=C9, =CE=C5=CB=CF=D4=CF=D2=D9=C5 =D0=D2=CF=C7=D2= =C1=CD=CD=D9 =D0=D2=CF=D3=D4=CF =CF=D4=CB=C1=DA=D9=D7=C1=C0=D4=D3=D1 =DA=C1= =D0=D5=D3=CB=C1=D4=D8=D3=D1 =CF=D4 =D2=D5=D4=C1. =EB=C1=D6=C5=D4=D3=D1, =D2=C1=CE=D8=DB=C5 perldoc =CE=C5 =DA=C1=D0=D5=D3=CB= =C1=CC=D3=D1 =CF=D4 =D2=D5=D4=C1. =F7 elinks'=C5 =C5=D3=D4=D8 =CF=D0=C3=C9= =D1 configure --enable-no-root enable prevention of usage by root =FA=C1=D0=D5=D3=CB=C1=D4=D8 =CE=C5=D4=D2=C9=D7=C9=C1=CC=D8=CE=D5=C0 =D0=D2= =CF=C7=D2=C1=CD=CD=D5 =CF=D4 =D2=D5=D4=C1 -- =CE=C5=C2=C5=DA=CF=D0=C1=D3=CE= =CF, =D0=D2=C9=CE=D5=C4=C9=D4=C5=CC=D8=CE=CF =DA=C1=D0=D2=C5=DD=C1=D4=D8 =C5=A3 =DA=C1=D0=D5=D3=CB=C1=D4=D8 -- =C7=CC=D5= =D0=CF. =F7 =D0=C5=D2=CC=C5 =C5=D3=D4=D8 =D2=C1=DA=D5=CD=CE=C1=D1 =C1=CC= =D8=D4=C5=D2=CE=C1=D4=C9=D7=C1 -- taint mode. > =F5 =CD=C5=CE=D1 umask 077 =C4=CC=D1 =CE=C5-root. =F3=D4=C1=CC=CF =C2=D9= =D4=D8, =D0=CF=D3=CC=C5 =F7=C1=DB=C5=CA =D5=D3=D4=C1=CE=CF=D7=CB=C9 =CE=C9= =CB=D4=CF =CE=C5=20 > =D0=CF=CC=D5=DE=C9=D4 =C4=CF=D3=D4=D5=D0 =CB =CD=CF=C4=D5=CC=D1=CD, =C5= =D3=CC=C9 =D3=D0=C5=C3=C9=C1=CC=D8=CE=CF =CE=C5 =C4=A3=D2=C7=C1=D4=D8=D3=D1. =E1 =D5 =CB=CF=C7=CF-=D4=CF, =CE=C1=CF=C2=CF=D2=CF=D4, umask 077 =C4=CC=D1 = root. =F3=D4=C1=CC=CF =C2=D9=D4=D8, =D0=CF=D3=CC=C5 =D4=C1=CB=CF=CA =D5=D3=D4=C1=CE=CF=D7=CB=C9 =CE=C9=CB=D4=CF =CE=C5 =D0=CF=CC=D5=DE=C9=D4 = =C4=CF=D3=D4=D5=D0 =CB =CD=CF=C4=D5=CC=D1=CD, =C5=D3=CC=C9 =D3=D0=C5=C3=C9= =C1=CC=D8=CE=CF =CE=C5 =C4=A3=D2=C7=C1=D4=D8=D3=D1. --iK/wEI4vkfDmI6Zw Content-Type: application/pgp-signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.5 (GNU/Linux) iD8DBQFCv+L8fBKgtDjnu0YRAjR8AKCV3jytFh0Mt6E/no6mW1OfSrMScgCaA6qb Mfp8sZLZkPUck8gnStFZKD8= =Qhy9 -----END PGP SIGNATURE----- --iK/wEI4vkfDmI6Zw--