search

Vykook / acme-sac

Automatically exported from code.google.com/p/acme-sac
Other
0 stars 0 forks source link

User's home directory should be sandboxed outside of Acme SAC's file system #9

Closed GoogleCodeExporter closed 8 years ago

GoogleCodeExporter commented 8 years ago 
Acme SAC's file tree is read-only, with the exception of /tmp and /usr.

Operating systems like Mac OS X and Linux often need to install programs in 
locations where
not all users have permission to write. This makes it difficult to maintain 
multiple user directories
in Acme SAC's file system, and it opens Acme SAC up to potential security 
problems.

The attached patch creates a directory called 'acme-home' in the user's home 
directory on the
host operating system and binds $home/acme-home to /usr/me and 
$home/acme-home/tmp
to /tmp. This makes Acme SAC's file system truly read-only and makes it 
possible for multiple
users to share one Acme SAC installation.

This patch has been tested under Mac OS X and Linux. Windows testing is needed.

--underspecified

Original issue reported on code.google.com by underspe...@gmail.com on 25 Oct 2007 at 4:16

Attachments:

GoogleCodeExporter commented 8 years ago 
this has been applied and user home directories are also sandboxed for windows.

Original comment by caerw...@gmail.com on 23 Nov 2007 at 10:56