ninit

The ninit security guarantee

I offer 100 Euro to the first person who publish a verifiable security hole in the latest stable version of ninit (0.12): for example, a way for a user to exploit ninit to take over another account.

Don't change the permition of files.

Execs + Dirs:         root:root 755
Ninit in/out pipes:   root:root 600
Man pages:            root:root 644
Files in /etc/ninit:  root:root 644

My judgment is final as to what constitutes a security hole in ninit. Any disputes will be reported here.

Remark /etc/ninit config subdirs
Ninit uses system functions like setuid, setgid, open, close. On some UNIX-like OS they are different. For example uid_t is uint16_t or uint32_t. There are also setuid32, setgid32, ... analogs of the above functions. Try to use for UID:GID numbers smaller than 65530. Who uses daemons with UID bigger than 65530? If somebody really needs such numbers let me know. How to use UID:GID see here. Don't make config files (for example depends 12G, environ 5G) too big also. I have set limits in the code.

2 November 2007, Sofia
Nikola Vladov

see also here
Last modifed: Tue, 27 Nov 2007 09:08:30