[Zope] Re: installation security best practice question

[Tres Seaver]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Luca Olivetti wrote:
> En/na Jens Vagelpohl ha escrit:
> 
>>
>> On 14 Mar 2006, at 15:13, Luca Olivetti wrote:
> 
> [...]
> 
>>> the same user, since I don't want to duplicate the zope installation,
>>> only the instance, and that should be possible (in fact it has been
>>> until now) without compromising security.
>>
>>
>> My point was that the "security" you speak of is illusory. You don't
>> win anything.
> 
> 
> I win 58M of space (since I install zope only once), and I lose nothing
> (unless you're saying that the product of "./configure; make; make
> install" is a security problem if world readable).

Note that I think the original poster must not have done 'make install',
but rather was using an inplace build directly from the unpacked
tarball:  the install process would have fixed up the permissions otherwise.


Tres.
- --
===================================================================
Tres Seaver          +1 202-558-7113          tseaver at palladion.com
Palladion Software   "Excellence by Design"    http://palladion.com
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org

iD8DBQFEFvMW+gerLs4ltQ4RAj+3AJ9tLsowf2algCaDuBmn5NUQUQgJegCgkEnO
4IXSI8Q4ORBMNcJy9j6SPXc=
=HTIJ
-----END PGP SIGNATURE-----