Re: libresolv+ bug

[dholland () hcs harvard edu (David Holland)]

> > Reading restricted file is not that much of a problem as long as you keep
> > the contents of the files secret, i.e., don't print "root:<pw>:::": parse
> > error at line 1.  Validate your input (for $TZ and $TERMINFO/$TERMCAP,
> > validating input is pretty easy, $TZ and $TERM* will only reveal
> > information if it happens to be in the right format)
>
> In the case of resolv, user resolv files should only be read if they are
> accessible as that user. This means going through all the usual mess because
> the designers of Unix didnt anticipate the fact that open(...., O_ASRUID)
> would have been useful.

One could argue that in a setuid program such user-supplied settings
should be ignored.

--
   - David A. Holland          | Number of words in the English language that
     dholland () hcs harvard edu  | exist because of typos or misreadings: 381