This is the mail archive of the
gcc@gcc.gnu.org
mailing list for the GCC project.
Re: new batch of replies (D)
"Joseph S. Myers" <jsm28@cam.ac.uk> writes:
> On Tue, 10 Dec 2002, Tom Lord wrote:
>
>> Yes, but any compromise that can run arbitrary code with the p4d id
>> can corrupt the repository.
>
> The presumption is that the protocol used to communicate with the daemon
> is as simple as possible and the daemon is well coded and audited (better
> than cvs server).
The presumption I'm making is more fundamental: if there's only one
user ID (ignoring root) with write privileges on the repository, and
the sysadmins have tight control over what processes can legitimately
run under that user ID, that reduces the number of potential
vulnerabilities that can lead to the repository being compromised.
It's a privilege-separation argument, not a ease-of-auditing argument.
zw